GitHub Advisoryadvisory · Maven

GHSA-v6w3-2prq-h95f Improper Input Validation in Jakarta Expression Language

MEDIUM Published 2021-10-06 Modified 2025-07-01 Official page ↗
Aliases
CVE-2021-28170
Ecosystem
Maven
Packages
com.sun.el:el-ri, org.glassfish:jakarta.el, org.glassfish:javax.el
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-20, CWE-917
Reviewed
2021-10-06

Affected packages

• Maven com.sun.el:el-ri: < 3.0.4 → fixed in 3.0.4 • Maven org.glassfish:jakarta.el: < 3.0.4 → fixed in 3.0.4 • Maven org.glassfish:javax.el: <= 3.0.1-b12 (no fix yet)

Description

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

Related

Alias · CVE (1)

  • CVE-2021-28170 In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References