Insecure Default Initialization of Resource in Pivotal Spring Web Flow

published 2017-06-13 9 y ago modified 2026-09-08 2 mo ago also GHSA-fg9w-cffm-pmh2 , EUVD-2022-3775

cvss: 5.9; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 14.7%; EPSS 14.7% chance of exploitation in 30 days, percentile 96%
public exploits: 0; none known

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

Patch / fix

fixed in 1 links 2

maven org.springframework.webflow:spring-webflow 2.4.5

jira.spring.io/browse/SWF-1700 patch
pivotal.io/security/cve-2017-4971 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-4971 updated 2026-11-07 cvss 5.0

spring-webflow: Data Binding Expression Vulnerability

Red Hat Enterprise Virtualization 3 jasperreports-server-pro
affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

14.69% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:P/A:N
GitHub	3.0	5.9	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.springframework.webflow:spring-webflow	>=2.4.0, <2.4.5	2.4.5

Affected products

n/a Spring Web Flow

Classification

Weakness

CWE-1188 Initialization of a Resource with an Insecure Default

References

pivotal.io /security/cve-2017-4971
web, mitigation, patch, vendor-advisory
jira.spring.io /browse/SWF-1700
web, issue-tracking, patch
securityfocus.com /bid/98785
vdb-entry, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2017-4971
advisory

Sources

CVE List CVE-2017-4971
GitHub Advisory GHSA-fg9w-cffm-pmh2
NVD CVE-2017-4971

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary