Executive Summary

CVE-2017-4971 exposes Pivotal Spring Web Flow (≤2.4.4) to malicious EL expression injection when the default useSpringBinding property is false and form submissions lack explicit data‑binding mappings. Attackers can craft view states that execute arbitrary EL code, potentially leading to remote code execution or data exfiltration. The vulnerability is not currently listed in the CISA KEV database.

---

Authoritative CVE Metadata - CVSS Base Score: 5.9 (MEDIUM) - Published: 2017-06-13T06:29:00.597 - Last Modified: 2026-09-08T17:13:05.477

Original Description: An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

"A thing long expected takes the form of the unexpected when at last it comes."

— Mark Twain