Executive Summary

CVE‑2017‑8039 affects Pivotal Spring Web Flow ≤2.4.5. When the MvcViewFactoryCreator.useSpringBinding flag remains at its default false, malicious EL expressions can be injected through view states that process form submissions lacking explicit data‑binding mappings. The flaw stems from an incomplete remediation of CVE‑2017‑4971 and enables attackers to execute arbitrary code or manipulate application logic. No CISA KEV listing yet.

---

Authoritative CVE Metadata - CVSS Base Score: 5.9 (MEDIUM) - Published: 2017-11-27T10:29:00.847 - Last Modified: 2026-09-08T17:13:05.477

Original Description: An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.

"Many people have gone further than they thought they could because someone else thought they could."

— Unknown