[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f23HobG9zYPoyFQG_NI5VhKIdIKQFIdPiEO7hZtcb3Ec":3,"g5a-risk:CVE-2017-4971":145},{"success":4,"data":5,"meta":143},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":38,"epssPercentile":15,"epssTimeSeries":39,"severity":40,"affectedProducts":41,"affectedProductsCount":56,"references":57,"referencesCount":82,"weaknesses":83,"weaknessesCount":92,"isActivelyExploited":93,"cisaInfo":15,"otxData":15,"relatedBlogPosts":94,"seoMetadata":95,"configurations":120,"relatedVendorCves":134,"notableEvents":135},"CVE-2017-4971","What is CVE-2017-4971?","An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.","An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding pro...","2017-06-13T06:29:00.597","2025-04-20T01:37:25.86",5.9,"CVSS:3.0\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:H\u002FA:N",{"CVSSMetricV31":15,"CVSSMetricV30":16,"CVSSMetricV2":29,"CVSSMetricV40":15},null,[17],{"Source":18,"Type":19,"CVSSData":20,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":21,"VectorString":13,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":24,"IntegrityImpact":23,"AvailabilityImpact":24,"BaseScore":12,"BaseSeverity":26,"ExploitCodeMaturity":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"TemporalSeverity":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"ModifiedAttackVector":15,"ModifiedAttackComplexity":15,"ModifiedPrivilegesRequired":15,"ModifiedUserInteraction":15,"ModifiedScope":15,"ModifiedConfidentialityImpact":15,"ModifiedIntegrityImpact":15,"ModifiedAvailabilityImpact":15,"EnvironmentalScore":15,"EnvironmentalSeverity":15},"3.0","NETWORK","HIGH","NONE","UNCHANGED","MEDIUM",2.2,3.6,[30],{"Source":18,"Type":19,"CVSSData":31,"BaseSeverity":26,"ExploitabilityScore":36,"ImpactScore":37,"ACInsufInfo":15,"ObtainAllPrivilege":15,"ObtainUserPrivilege":15,"ObtainOtherPrivilege":15,"UserInteractionRequired":15},{"Version":32,"VectorString":33,"AccessVector":22,"AccessComplexity":26,"Authentication":24,"ConfidentialityImpact":24,"IntegrityImpact":34,"AvailabilityImpact":24,"BaseScore":35,"BaseSeverity":15,"Exploitability":15,"RemediationLevel":15,"ReportConfidence":15,"TemporalScore":15,"CollateralDamagePotential":15,"TargetDistribution":15,"ConfidentialityRequirement":15,"IntegrityRequirement":15,"AvailabilityRequirement":15,"EnvironmentalScore":15},"2.0","AV:N\u002FAC:M\u002FAu:N\u002FC:N\u002FI:P\u002FA:N","PARTIAL",4.3,8.6,2.9,0.14688,[38,38,38,38,38,38,38],"Medium",[42,47,50,53],{"vendor":43,"product":44,"version":45,"criteria":46,"vulnerable":4},"pivotal","spring_web_flow","2.4.0","cpe:2.3:a:pivotal:spring_web_flow:2.4.0:*:*:*:*:*:*:*",{"vendor":43,"product":44,"version":48,"criteria":49,"vulnerable":4},"2.4.1","cpe:2.3:a:pivotal:spring_web_flow:2.4.1:*:*:*:*:*:*:*",{"vendor":43,"product":44,"version":51,"criteria":52,"vulnerable":4},"2.4.2","cpe:2.3:a:pivotal:spring_web_flow:2.4.2:*:*:*:*:*:*:*",{"vendor":43,"product":44,"version":54,"criteria":55,"vulnerable":4},"2.4.4","cpe:2.3:a:pivotal:spring_web_flow:2.4.4:*:*:*:*:*:*:*",4,[58,64,70,76,78,80],{"url":59,"source":60,"tags":61},"http:\u002F\u002Fwww.securityfocus.com\u002Fbid\u002F98785","Securityfocus",[62,63],"Third Party Advisory","VDB Entry",{"url":65,"source":66,"tags":67},"https:\u002F\u002Fjira.spring.io\u002Fbrowse\u002FSWF-1700","Spring",[68,69],"Issue Tracking","Patch",{"url":71,"source":72,"tags":73},"https:\u002F\u002Fpivotal.io\u002Fsecurity\u002Fcve-2017-4971","Pivotal",[74,69,75],"Mitigation","Vendor Advisory",{"url":59,"source":60,"tags":77},[62,63],{"url":65,"source":66,"tags":79},[68,69],{"url":71,"source":72,"tags":81},[74,69,75],6,[84],{"id":85,"name":86,"description":87,"extendedDescription":88,"status":89,"abstraction":90,"structure":91},"CWE-1188","Initialization of a Resource with an Insecure Default","The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.","Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value.  However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.","Incomplete","Base","Simple",1,false,[],{"title":96,"metaDescription":97,"keywords":98,"canonicalUrl":99,"structuredData":100},"What is CVE-2017-4971? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2017-4971, a medium severity cyber security vulnerability from 2017. An issue was discovered in Pivotal Spring Web Flow through...","CVE-2017-4971, CVE-2017-4971 vulnerability, CVE-2017-4971 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2017, CVSS score, exploit, patch, remediation, pivotal security, spring_web_flow vulnerability","\u002Fwhat-is\u002Fcve-2017-4971",{"@context":101,"@type":102,"headline":96,"description":97,"datePublished":10,"dateModified":11,"author":103,"publisher":107,"about":111,"mainEntityOfPage":115,"articleSection":118,"keywords":119},"https:\u002F\u002Fschema.org","TechArticle",{"@type":104,"name":105,"url":106},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":104,"name":105,"url":106,"logo":108},{"@type":109,"url":110},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":112,"name":6,"description":113,"additionalType":114},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":116,"@id":117},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2017-4971","Cybersecurity","CVE-2017-4971, CVE-2017-4971 vulnerability, CVE-2017-4971 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[121],{"Operator":15,"Negate":15,"Nodes":122},[123],{"Operator":124,"Negate":15,"CPEMatch":125},"OR",[126,128,130,132],{"Vulnerable":4,"Criteria":46,"MatchCriteriaID":127,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"59073ACA-F7C5-4C50-85E7-80073ED4358A",{"Vulnerable":4,"Criteria":49,"MatchCriteriaID":129,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"4C2CF5C8-DA12-4778-9072-27F27BACAF8C",{"Vulnerable":4,"Criteria":52,"MatchCriteriaID":131,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"32B5074F-2E48-4A4E-AA19-D8883775A818",{"Vulnerable":4,"Criteria":55,"MatchCriteriaID":133,"VersionStartExcluding":15,"VersionStartIncluding":15,"VersionEndExcluding":15,"VersionEndIncluding":15},"CB71B411-A6F7-4EE3-BE6C-91DFF15DA656",[],[136],{"id":137,"eventType":138,"eventTime":139,"details":140,"label":141,"color":142},"77fac910-4f82-46a6-91d2-639d466a1360","LOW_EPSS_DELTA","2026-06-16T04:06:22.097964+00:00","Daily EPSS score decreased by 0.615 on 2023-12-30","EPSS Score Decreased","green",{"lastModified":11,"cacheTime":144,"version":32},1792372285806,{"score":146,"band":40,"action":147,"scoredAt":148},42,"Plan remediation","2026-10-16T06:42:01.835096+00:00"]