CVE-2021-28170

Improper Input Validation in Jakarta Expression Language

Description

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading

Vulnerability Details

Score

5.3

Score Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected Versions

com.sun.el:el-ri < 3.0.4; org.glassfish:jakarta.el < 3.0.4

Severity

Medium

Ecosystem

Java

Publish Date

October 6, 2021

Modified Date

July 1, 2025