CVE-2017-4971

MEDIUM Year: 2017
CVSS v3 Score
5.9
Medium
CVSS v2 Score
4.3
Medium
Weakness Type
CWE-1188
View all →

Vulnerability Description

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

Related Vulnerabilities

CVE-2017-8039

MEDIUM
CVSS:5.9(Medium)

An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., s...

CWE-11882017

CVE-2025-2129

MEDIUM
CVSS:5.6(Medium)

A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default initialization of resource. It is possible ...

CWE-11882025

CVE-2019-2197

MEDIUM
CVSS:5.5(Medium)

In processPhonebookAccess of CachedBluetoothDevice.java, there is a possible permission bypass due to an insecure default value. This could lead to local information disclosure of the user's contact l...

CWE-11882019

CVE-2020-0019

MEDIUM
CVSS:5.5(Medium)

In the Broadcom Nexus firmware, there is an insecure default password. This could lead to local information disclosure in the kernel with no additional execution privileges needed. User interaction is...

CWE-11882020

CVE-2021-47343

MEDIUM
CVSS:5.5(Medium)

In the Linux kernel, the following vulnerability has been resolved: dm btree remove: assign new_root only when removal succeeds remove_raw() in dm_btree_remove() may fail due to IO read error (e.g. re...

CWE-11882021

CVE-2022-20466

MEDIUM
CVSS:5.5(Medium)

In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's password on a secondary display due to an insecure default value. This could lead to ...

CWE-11882022