-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from insecure default configuration in MvcViewFactoryCreator where useSpringBinding=false. The createViewFactory method's behavior changes based on this property - when disabled, it skips adding SpringBindingTag validation. The patch (57f2ccb) explicitly sets useSpringBinding=true by default to enforce binding validation. Runtime detection would focus on invocations of createViewFactory when useSpringBinding=false, which would appear in stack traces during view template processing of vulnerable form submissions.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.springframework.webflow:spring-webflow | maven | >= 2.4.0, <= 2.4.4 | 2.4.5 |