CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVE-2021-28170
Medium (5.3). EPSS 2.1% chance of exploitation in the next 30 days. Fixed in com.sun.el:el-ri 3.0.4.
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
Severity
- EPSS
- 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-917, CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- eclipse:jakarta_expression_language
- oracle:communications_cloud_native_core_policy
- oracle:weblogic_server
- quarkus:quarkus
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v6w3-2prq-h95f | Maven | com.sun.el:el-ri | <3.0.4 | 3.0.4 |
| GHSA-v6w3-2prq-h95f | Maven | org.glassfish:jakarta.el | <3.0.4 | 3.0.4 |
| GHSA-v6w3-2prq-h95f | Maven | org.glassfish:javax.el | <=3.0.1-b12 | no fix published |