PT-2017-16234
CVE-2017-4971
·
Publicado
2017-06-13
·
Atualizado
2022-05-13
Descrição por
CVSS 3.1
5.9
MédiaMétricasAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Pivotal Spring Web Flow versions prior to 2.4.5
Description
The issue concerns malicious EL expressions in view states that process form submissions. This can affect applications that do not change the value of the
useSpringBinding property, which is disabled by default.Recommendations
For versions prior to 2.4.5, update to version 2.4.5 or later to resolve the issue. As a temporary workaround, consider enabling the
useSpringBinding property to prevent malicious EL expressions.Explorabilidade
Exploit
Correção
Pesquisadores
Fornecedores
Produtos afetados
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾