PT-2017-18084

Name of the Vulnerable Software and Affected Versions Pivotal Spring Web Flow versions prior to 2.5 Description An issue was discovered in Pivotal Spring Web Flow where applications that do not change the value of the useSpringBinding property, which is disabled by default, can be vulnerable to...

CVE-2017-8039

An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default i.e., set to 'false' can be vulnerable to malicious EL expressions in view states that process form...

Data Binding Expression Vulnerability in Spring Web Flow

This CVE addresses a second path to exploiting the same vulnerability as the one described under CVE-2017-4971 . Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default i.e. set to “false” can be vulnerable to malicious EL...

PT-2017-16234

Name of the Vulnerable Software and Affected Versions Pivotal Spring Web Flow versions prior to 2.4.5 Description The issue concerns malicious EL expressions in view states that process form submissions. This can affect applications that do not change the value of the useSpringBinding property,...

Data Binding Expression Vulnerability

Spring Web Flow is vulnerable to a data binding expression vulnerability. The vulnerability is possible because the MvcViewFactoryCreator useSpringBinding property is set to false by default. Therefore, the applications which use the default settings are vulnerable to malicious EL expressions in...

Data Binding Expression Vulnerability in Spring Web Flow

Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default i.e. set to “false” can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data bindi...