CVE-2017-8039 json
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
published 2017-11-27 8 y ago modified 2026-09-08 2 mo ago also GHSA-q4v9-qjmw-j7vf , EUVD-2022-4886
- cvss
- 5.9
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.
Patch / fix
- maven org.springframework.webflow:spring-webflow 2.4.6
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2017-8039 updated cvss 5.0
spring-webflow: Data Binding Expression Vulnerability in Spring Web Flow
-
Red Hat Enterprise Virtualization 3 jasperreports-server-proaffected: no fix planned “Will not fix”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.13% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| GitHub | 3.0 | 5.9 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.springframework.webflow:spring-webflow | <2.4.6 |
2.4.6 |
Affected products
- n/a Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected
Classification
- Weakness
-
- CWE-1188 Initialization of a Resource with an Insecure Default
References
-
pivotal.io
/security/cve-2017-8039
web, issue-tracking, mitigation, vendor-advisory
-
securityfocus.com
/bid/100849
vdb-entry, web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2017-8039
advisory
Sources
- CVE List CVE-2017-8039
- GitHub Advisory GHSA-q4v9-qjmw-j7vf
- NVD CVE-2017-8039
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.