An issue was discovered in Pivotal Spring Web Flow through 2.4.4.
Priority MEDIUM 42CWE-1188Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.
Why it matters now
EPSS 0.14688 96th percentileScored 2026-11-07
Fix Partial org.springframework.webflow:spring-webflow (Maven): 2.4.5Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Spring Web Flow | Spring Web Flow | — | No fix listed | CNA |
| — | org.springframework.webflow:spring-webflow (Maven) | 2.4.0 to before 2.4.5 | 2.4.5 | Patch available | GHSA-fg9w-cffm-pmh2 |
- Spring Web Flow Vendor— Affected Spring Web Flow Fixed in — No fix listed CNA
- org.springframework.webflow:spring-webflow (Maven) Vendor— Affected 2.4.0 to before 2.4.5 Fixed in 2.4.5 Patch available GHSA-fg9w-cffm-pmh2
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:broadcom:spring_web_flow:2.4.0:*:*:*:*:*:*:* | 2.4.0 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:spring_web_flow:2.4.1:*:*:*:*:*:*:* | 2.4.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:spring_web_flow:2.4.2:*:*:*:*:*:*:* | 2.4.2 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:spring_web_flow:2.4.4:*:*:*:*:*:*:* | 2.4.4 | Vulnerable | Broadcom |
- cpe:2.3:a:broadcom:spring_web_flow:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:spring_web_flow:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:spring_web_flow:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:spring_web_flow:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·Broadcom
Remediation
- Fix · GHSA-fg9w-cffm-pmh2 org.springframework.webflow:spring-webflow (Maven) Fixed in 2.4.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Virtualization 3 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-4971
- 2026-10-03 Alias added: GHSA-fg9w-cffm-pmh2
References
More Broadcom Spring Web Flow vulnerabilities
- TI-2026-29636 Data Binding Vulnerability in Spring Web Flow with Unified EL Parser CVSS 3.1MEDIUM 6.4
- TI-2017-05632 An issue was discovered in Pivotal Spring Web Flow through 2.4.5. CVSS 3.0MEDIUM 5.9
- TI-2026-29637 Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML CVSS 3.1MEDIUM 4.8
Sources
- CVE-2017-4971 · CVE Program
- CVE-2017-4971 · NVD
- FIRST EPSS
- GHSA-fg9w-cffm-pmh2 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-4971 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences