Skip to content
Fencer Intel
medium 5.9

CVE-2017-8039 json

Insecure Default Initialization of Resource in Pivotal Spring Web Flow

published 2017-11-27 8 y ago modified 2026-09-08 2 mo ago also GHSA-q4v9-qjmw-j7vf , EUVD-2022-4886

cvss
5.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.

Patch / fix

  • maven org.springframework.webflow:spring-webflow 2.4.6

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-8039 updated cvss 5.0

spring-webflow: Data Binding Expression Vulnerability in Spring Web Flow

  • Red Hat Enterprise Virtualization 3 jasperreports-server-pro
    affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub 3.0 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.springframework.webflow:spring-webflow
<2.4.6
2.4.6

Affected products

  • n/a Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected

Classification

Weakness
  • CWE-1188 Initialization of a Resource with an Insecure Default

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.