CVE-2017-8039

An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.

• CWE-1188

• https://www.securityfocus.com/bid/100849Third Party Advisory, VDB Entry
• https://pivotal.io/security/cve-2017-8039Issue Tracking, Mitigation, Vendor Advisory
• https://www.securityfocus.com/bid/100849Third Party Advisory, VDB Entry
• https://pivotal.io/security/cve-2017-8039Issue Tracking, Mitigation, Vendor Advisory

Published

Nov 27, 2017

Last Modified

Sep 8, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-8033An issue was discovered in the Cloud Controller API in Cloud…7.8
• CVE-2017-8034The Cloud Controller and Router in Cloud Foundry (CAPI-relea…
• CVE-2017-8035An issue was discovered in the Cloud Controller API in Cloud…7.5
• CVE-2017-8036An issue was discovered in the Cloud Controller API in Cloud…7.8
• CVE-2017-8037In Cloud Foundry Foundation CAPI-release versions after v1.6…
• CVE-2017-8038In Cloud Foundry Foundation Credhub-release version 1.1.0, a…
• CVE-2017-8040In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x vers…6.5
• CVE-2017-8041In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x vers…6.1
• CVE-2017-8042Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8043Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-8044In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1…6.1
• CVE-2017-8045In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and …