An issue was discovered in Pivotal Spring Web Flow through 2.4.5.
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected | Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected | — | No fix listed | CNA |
| — | org.springframework.webflow:spring-webflow (Maven) | before 2.4.6 | 2.4.6 | Patch available | GHSA-q4v9-qjmw-j7vf |
- Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected Vendor— Affected Spring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected Fixed in — No fix listed CNA
- org.springframework.webflow:spring-webflow (Maven) Vendor— Affected before 2.4.6 Fixed in 2.4.6 Patch available GHSA-q4v9-qjmw-j7vf
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:broadcom:spring_web_flow:2.4.0:*:*:*:*:*:*:* | 2.4.0 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:spring_web_flow:2.4.1:*:*:*:*:*:*:* | 2.4.1 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:spring_web_flow:2.4.2:*:*:*:*:*:*:* | 2.4.2 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:spring_web_flow:2.4.4:*:*:*:*:*:*:* | 2.4.4 | Vulnerable | Broadcom |
| cpe:2.3:a:broadcom:spring_web_flow:2.4.5:*:*:*:*:*:*:* | 2.4.5 | Vulnerable | Broadcom |
- cpe:2.3:a:broadcom:spring_web_flow:2.4.0:*:*:*:*:*:*:* Versions 2.4.0 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:spring_web_flow:2.4.1:*:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:spring_web_flow:2.4.2:*:*:*:*:*:*:* Versions 2.4.2 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:spring_web_flow:2.4.4:*:*:*:*:*:*:* Versions 2.4.4 Vulnerable ·Broadcom
- cpe:2.3:a:broadcom:spring_web_flow:2.4.5:*:*:*:*:*:*:* Versions 2.4.5 Vulnerable ·Broadcom
Remediation
- Fix · GHSA-q4v9-qjmw-j7vf org.springframework.webflow:spring-webflow (Maven) Fixed in 2.4.6 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Virtualization 3 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-8039
- 2026-10-03 Alias added: GHSA-q4v9-qjmw-j7vf
References
More Broadcom Spring Web Flow vulnerabilities
- TI-2017-03095 An issue was discovered in Pivotal Spring Web Flow through 2.4.4. CVSS 3.0MEDIUM 5.9
- TI-2026-29636 Data Binding Vulnerability in Spring Web Flow with Unified EL Parser CVSS 3.1MEDIUM 6.4
- TI-2026-29637 Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML CVSS 3.1MEDIUM 4.8
Sources
- CVE-2017-8039 · CVE Program
- CVE-2017-8039 · NVD
- FIRST EPSS
- GHSA-q4v9-qjmw-j7vf · GitHub Advisory Database · CC BY 4.0
- CVE-2017-8039 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences