Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2017-8039

Good to know:

icon
icon

Date: November 27, 2017

An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.

Language: Java

Severity Score

Related Resources (5)

https://pivotal.io/security/cve-2017-8039
http://www.securityfocus.com/bid/100849
https://nvd.nist.gov/vuln/detail/CVE-2017-8039
https://www.mend.io/resources/blog/top-5-open-source-security-vulnerabilities-in-december
https://www.mend.io/vulnerability-database/CVE-2017-8039

Severity Score

Weakness Type (CWE)

Security Features

CWE-254

Insecure Default Initialization of Resource

CWE-1188

Top Fix

icon

Upgrade Version

Upgrade to version 2.4.6.RELEASE

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): NONE
Integrity (I): PARTIAL
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us