GitHub Advisoryadvisory · Maven

GHSA-fg9w-cffm-pmh2 Insecure Default Initialization of Resource in Pivotal Spring Web Flow

MEDIUM Published 2022-05-13 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-4971
Ecosystem
Maven
Packages
org.springframework.webflow:spring-webflow
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1188
Reviewed
2022-07-01

Affected packages

• Maven org.springframework.webflow:spring-webflow: >= 2.4.0, < 2.4.5 → fixed in 2.4.5

Description

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

Related

Alias · CVE (1)

  • CVE-2017-4971 An issue was discovered in Pivotal Spring Web Flow through 2.4.4. vulnerability

Weakness · CWE (1)

  • CWE-1188 Initialization of a Resource with an Insecure Default weakness

References