MEDIUM 6.4

GHSA-9ggw-87m9-9gfc

Spring Web Flow has Data Binding Vulnerability with Unified EL Parser

Quick fix

GHSA-9ggw-87m9-9gfc — org.springframework.webflow:spring-webflow: upgrade to the fixed version with the command below.

# pom.xml: bump <version>4.0.1</version> for org.springframework.webflow:spring-webflow

Details

Applications that configure the WebFlowELExpressionParser are vulnerable to the use of malicious Unified EL expressions.

Affected versions: Spring Web Flow 4.0.0; 3.0.0 through 3.0.1; 2.5.0 through 2.5.1.

Enter the version of the package you're using.

Introduced in: 4.0.0 Fixed in: 4.0.1

Fix # pom.xml: bump <version>4.0.1</version> for org.springframework.webflow:spring-webflow

Introduced in: 3.0.0 Fixed in: 3.0.2

Fix # pom.xml: bump <version>3.0.2</version> for org.springframework.webflow:spring-webflow

Introduced in: 0

No fixed version published yet for org.springframework.webflow:spring-webflow (maven). Pin to a known-safe version or switch to an alternative.