Improper Input Validation in Jakarta Expression Language

MEDIO 5.3CVE-2021-28170 · GHSA-v6w3-2prq-h95f · Published 26/05/2021 · updated 17/06/2026

In breve

CVE-2021-28170 è una vulnerabilità MEDIO (CVSS 5.3) che riguarda com.sun.el:el-ri, org.glassfish:jakarta.el, org.glassfish:javax.el.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.1%, superiore al 82.0% delle vulnerabilità.
Correzione: aggiornare a 3.0.4, 2.3.0 o successiva.

Package	Affected versions	Patched versions
com.sun.el:el-ri Maven	`< 3.0.4`	`3.0.4`
org.glassfish:jakarta.el Maven	`< 3.0.4`	`3.0.4`
org.glassfish:javax.el Maven	`≤ 3.0.1-b12`	No fix yet
jakarta expression language eclipse	`≤ 3.0.3`	No fix yet
communications cloud native core policy oracle	`= 1.14.0`	No fix yet
weblogic server oracle	`= 14.1.1.0.0`	No fix yet
quarkus quarkus	`< 2.3.0`	`2.3.0`

Description

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

NVD description

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

References

nvd.nist.gov/vuln/detail/CVE-2021-28170 · ADVISORY
eclipse-ee4j/el-ri · WEB
eclipse-ee4j/el-ri#160 · WEB
eclipse-ee4j/el-ri · PACKAGE
security.snyk.io/vuln/SNYK-JAVA-ORGGLASSFISH-1297098 · WEB
security.snyk.io/vuln/SNYK-JAVA-ORGGLASSFISH-2841368 · WEB
securitylab.github.com/advisories/GHSL-2020-021-jakarta-el · ADVISORY
oracle.com/security-alerts/cpuapr2022.html · WEB
securitylab.github.com/advisories/GHSL-2020-021-jakarta-el · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free