jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate

🗓️ 13 Sep 2021 17:34:00Reported by RedHatType

redhat🔗 access.redhat.com👁 2 Views

Jakarta EL 3.0.3 and earlier ELParserTokenManager allows invalid expressions to be evaluated.

Reporter	Title	Published	Views	Family All 75
IBM Security Bulletins	Security Bulletin: Common vulnerabilities fixed in Cloudera Data Platform 7.1.9 HF2	7 May 202419:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilties affect IBM Db2 Big SQL on Cloud Pak for Data	7 Jan 202521:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities disclosed in IBM Eclipse SDK affect IBM SPSS Collaboration and Deployment Services	28 Mar 202518:05	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Eclipse EE4J Jakarta Expression Language affects watsonx.data	30 Jan 202513:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is vulnerable to remote attacker security restrictions bypass due to Eclipse EE4J Jakarta Expression Language (CVE-2021-28170)	13 Jun 202217:43	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple security vulnerabilities in Apache Storm used by IBM Tivoli Netcool Manager.	21 Jul 202204:32	–	ibm
ATTACKERKB	CVE-2021-28170	26 May 202122:15	–	attackerkb
BDU FSTEC	The vulnerability of the ELParserTokenManager function in the Jakarta EL programming language lies in insufficient validation of input data, allowing attackers to compromise the integrity of the data.	20 Sep 202100:00	–	bdu_fstec
CNNVD	Jakarta Expression Language 输入验证错误漏洞	26 May 202100:00	–	cnnvd
CVE	CVE-2021-28170	26 May 202121:55	–	cve

Vulners

Node

AND

redhat jboss_enterprise_application_platform_xpRange<2.0

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-28170
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-28170
securitylab	www.securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/
cve	www.cve.org/CVERecord

07 Sep 2026 14:19Current

CVSS 25

CVSS 3.15.3

EPSS0.02132

jakarta-el ELParserTokenManager invalid expression parsing flaw expression evaluation