{
  "@id": "urn:uuid:4b6df2dd-53bf-4311-b884-6697162797d1",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 5,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T16:52:00.226722+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.webflow/spring-webflow@3.0.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.webflow/spring-webflow@3.0.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T14:22:27.284985+00:00",
      "status_notes": "Vulnerability CVE-2017-4971 affects version 3.0.2-tuxcare.1 of org.springframework.webflow:spring-webflow.",
      "vulnerability": {
        "name": "CVE-2017-4971"
      },
      "action_statement": "Vulnerability CVE-2017-4971 affects version 3.0.2-tuxcare.1 of org.springframework.webflow:spring-webflow."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.webflow/spring-webflow@3.0.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.webflow/spring-webflow@3.0.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T16:52:00.226722+00:00",
      "status_notes": "Vulnerability CVE-2017-8039 does not affect version 3.0.2-tuxcare.1 of org.springframework.webflow:spring-webflow. not_affected \u2014 CVE-2017-8039 affects Spring Web Flow applications that process malicious EL expressions in view state form submissions when useSpringBinding is disabled (default). The vulnerability allows arbitrary expression evaluation through unvalidated request parameters. The target repository (Spring Web Flow 3.0.2-tuxcare.2) is NOT AFFECTED because the upstream fix (commit 084b4e71) was already present ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2017-8039"
      },
      "impact_statement": "not_affected \u2014 CVE-2017-8039 affects Spring Web Flow applications that process malicious EL expressions in view state form submissions when useSpringBinding is disabled (default). The vulnerability allows arbitrary expression evaluation through unvalidated request parameters. The target repository (Spring Web Flow 3.0.2-tuxcare.2) is NOT AFFECTED because the upstream fix (commit 084b4e71) was already present ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.webflow/spring-webflow@3.0.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.webflow/spring-webflow@3.0.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T08:33:02.922787+00:00",
      "status_notes": "Vulnerability CVE-2026-40985 does not affect version 3.0.2-tuxcare.1 of org.springframework.webflow:spring-webflow. not_affected \u2014 The target repository spring-webflow version 3.0.2-tuxcare.2 is NOT AFFECTED by CVE-2026-40985. The vulnerability concerns malicious Unified EL expression execution through HTTP request parameter binding when WebFlowELExpressionParser is configured. The upstream fix (commit 2e3e8209271aaecebcd475a1e895413a960cd611 by rossen.stoyanchev@broadcom.com) was already present in the upstream v3.0.2 rel...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40985"
      },
      "impact_statement": "not_affected \u2014 The target repository spring-webflow version 3.0.2-tuxcare.2 is NOT AFFECTED by CVE-2026-40985. The vulnerability concerns malicious Unified EL expression execution through HTTP request parameter binding when WebFlowELExpressionParser is configured. The upstream fix (commit 2e3e8209271aaecebcd475a1e895413a960cd611 by rossen.stoyanchev@broadcom.com) was already present in the upstream v3.0.2 rel..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.webflow/spring-webflow@3.0.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.webflow/spring-webflow@3.0.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T08:33:02.922787+00:00",
      "status_notes": "Vulnerability CVE-2026-40986 does not affect version 3.0.2-tuxcare.1 of org.springframework.webflow:spring-webflow. not_affected \u2014 CVE-2026-40986: Spring Web Flow JavaScript RemotingHandler XSS vulnerability is NOT present in the target. The upstream vendor (Broadcom/Spring) fixed this vulnerability in commit 17299d158a937ce4a2189bda36074a0707fb4be5, which was included in the upstream Spring Web Flow 3.0.2 release. The target repository at version 3.0.2-tuxcare.2 (HEAD: 4225f16f) contains this upstream fix, which was alrea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40986"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-40986: Spring Web Flow JavaScript RemotingHandler XSS vulnerability is NOT present in the target. The upstream vendor (Broadcom/Spring) fixed this vulnerability in commit 17299d158a937ce4a2189bda36074a0707fb4be5, which was included in the upstream Spring Web Flow 3.0.2 release. The target repository at version 3.0.2-tuxcare.2 (HEAD: 4225f16f) contains this upstream fix, which was alrea..."
    }
  ]
}