CVE-2017-8039
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property (disabled by default) can be vulnerable to malicious EL expressions in view states that process form submissions without explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.
Risk Assessment
Risk of executing malicious EL expressions, similar to CVE-2017-4971, potentially leading to remote code execution or unauthorized access.
Recommendation
Recommend applying the complete fix for CVE-2017-4971 and setting useSpringBinding to 'true' or explicitly mapping data binding properties.
Other vulnerabilities in Spring Web Flow
See all- CVE-2017-4971Medium
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property (disabled by default) can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.
- CVE-2026-40986Medium
Vulnerability in Spring Web Flow where the JavaScript RemotingHandler renders the error response body as HTML even when the response is not 'text/html'. This can lead to a scripting attack in the user's browser if the error response contains attacker-reflected data. Affects versions 4.0.0, 3.0.0-3.0.1, 2.5.0-2.5.1.
- CVE-2026-40985Medium
Applications that configure WebFlowELExpressionParser are vulnerable to malicious Unified EL expressions. Affected versions: Spring Web Flow 4.0.0, 3.0.0-3.0.1, and 2.5.0-2.5.1.
Original NVD description (English source)
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.