{"id":"GHSA-v6w3-2prq-h95f","summary":"Improper Input Validation in Jakarta Expression Language","details":"In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.","aliases":["CVE-2021-28170"],"modified":"2025-07-01T16:41:01.084020Z","published":"2021-10-06T17:48:38Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2021-10-06T13:31:54Z","nvd_published_at":"2021-05-26T22:15:00Z","cwe_ids":["CWE-20","CWE-917"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28170"},{"type":"WEB","url":"https://github.com/eclipse-ee4j/el-ri/issues/155"},{"type":"WEB","url":"https://github.com/eclipse-ee4j/el-ri/pull/160/commits/b6a3943ac5fba71cbc6719f092e319caa747855b"},{"type":"PACKAGE","url":"https://github.com/eclipse-ee4j/el-ri"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGGLASSFISH-1297098"},{"type":"WEB","url":"https://security.snyk.io/vuln/SNYK-JAVA-ORGGLASSFISH-2841368"},{"type":"ADVISORY","url":"https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuapr2022.html"}],"affected":[{"package":{"name":"com.sun.el:el-ri","ecosystem":"Maven","purl":"pkg:maven/com.sun.el/el-ri"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}],"versions":["1.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-v6w3-2prq-h95f/GHSA-v6w3-2prq-h95f.json"}},{"package":{"name":"org.glassfish:jakarta.el","ecosystem":"Maven","purl":"pkg:maven/org.glassfish/jakarta.el"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.4"}]}],"versions":["3.0.2","3.0.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-v6w3-2prq-h95f/GHSA-v6w3-2prq-h95f.json"}},{"package":{"name":"org.glassfish:javax.el","ecosystem":"Maven","purl":"pkg:maven/org.glassfish/javax.el"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.1-b12"}]}],"versions":["3.0-b01","3.0-b02","3.0-b03","3.0-b04","3.0-b05","3.0-b06","3.0-b07","3.0.0","3.0.1-b01","3.0.1-b02","3.0.1-b03","3.0.1-b04","3.0.1-b05","3.0.1-b06","3.0.1-b07","3.0.1-b08","3.0.1-b09","3.0.1-b10","3.0.1-b11","3.0.1-b12"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-v6w3-2prq-h95f/GHSA-v6w3-2prq-h95f.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}