CVE-2021-28170
published 2021-05-26CVE-2021-28170: In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if…
PriorityP425medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
2.13%
80.0th percentile
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jakarta-el-api | — | — |
| eclipse | jakarta_expression_language | <= 3.0.3 | — |
| oracle | communications_cloud_native_core_policy | — | — |
| oracle | weblogic_server | — | — |
| quarkus | quarkus | < 2.3.0 | 2.3.0 |
| the_eclipse_foundation | jakarta_expression_language_implementation | unspecified – 3.0.3 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.3MEDIUM
vendor_debian5.3LOW
vendor_oracle5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Common Core (Jakarta Expression Language) — CVE-2021-28170
vendor_oracle·2025-04-15·CVSS 5.3
CVE-2021-28170 [MEDIUM] Oracle Oracle Financial Services Applications Risk Matrix: Common Core (Jakarta Expression Language) — CVE-2021-28170
Oracle Oracle Financial Services Applications Risk Matrix: Common Core (Jakarta Expression Language) vulnerability
CVE: CVE-2021-28170
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
Oracle
Oracle Oracle Commerce Risk Matrix: Dynamo Application Framework (Jakarta Expression Language) — CVE-2021-28170
vendor_oracle·2024-10-15·CVSS 5.3
CVE-2021-28170 [MEDIUM] Oracle Oracle Commerce Risk Matrix: Dynamo Application Framework (Jakarta Expression Language) — CVE-2021-28170
Oracle Oracle Commerce Risk Matrix: Dynamo Application Framework (Jakarta Expression Language) vulnerability
CVE: CVE-2021-28170
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Oracle
Oracle Oracle Communications Risk Matrix: Policy (Jakarta) — CVE-2021-28170
vendor_oracle·2022-04-15·CVSS 5.3
CVE-2021-28170 [MEDIUM] Oracle Oracle Communications Risk Matrix: Policy (Jakarta) — CVE-2021-28170
Oracle Oracle Communications Risk Matrix: Policy (Jakarta) vulnerability
CVE: CVE-2021-28170
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2022 (APR 2022)
Red Hat
jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
vendor_redhat·2021-04-01·CVSS 5.3
CVE-2021-28170 [MEDIUM] CWE-20 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
Package: jakarta.el (Red Hat build of Quarkus) - Affected
Package: jakarta.el (Red Hat Decision Manager 7) - Not affected
Package: jakarta-el (Red Hat Enterprise Linux 9) - Affected
Package: jakarta.el (Red Hat Integration Camel K 1) - Affected
Package: jakarta.el (Red Hat Integration Camel Quarkus 1) - Affected
Package: jakarta.el (Red Hat Integration Service Registry) - Not affected
Package: jakarta.el (Red Hat JBoss Data Grid 7) - Out of support scope
Package: jakarta.el (Red Hat OpenShift Application Runtimes) - Affected
Package
Debian
CVE-2021-28170: jakarta-el-api - In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in th...
vendor_debian·2021·CVSS 5.3
CVE-2021-28170 [MEDIUM] CVE-2021-28170: jakarta-el-api - In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in th...
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
Improper Input Validation in Jakarta Expression Language
osv·2021-10-06
CVE-2021-28170 [MEDIUM] Improper Input Validation in Jakarta Expression Language
Improper Input Validation in Jakarta Expression Language
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
GHSA
Improper Input Validation in Jakarta Expression Language
ghsa·2021-10-06
CVE-2021-28170 [MEDIUM] CWE-20 Improper Input Validation in Jakarta Expression Language
Improper Input Validation in Jakarta Expression Language
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
OSV
CVE-2021-28170: In the Jakarta Expression Language implementation 3
osv·2021-05-26·CVSS 5.3
CVE-2021-28170 [MEDIUM] CVE-2021-28170: In the Jakarta Expression Language implementation 3
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
bugzilla·2021-05-27·CVSS 5.3
CVE-2021-28170 [MEDIUM] CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
References:
https://github.com/eclipse-ee4j/el-ri/issues/155
https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/
Discussion:
Created jakarta-el tracking bugs for this issue:
Affects: fedora-all [bug 1965500]
---
This issue has been addressed in the following products:
EAP 7.3.9 release
Via RHSA-2021:3471 https://access.redhat.com/errata/RHSA-2021:3471
---
This issue has been addressed in the following products:
Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8
Via RHSA-2021:3468 https://
Tenable
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
blogs_tenable·2022-04-20
Oracle April 2022 Critical Patch Update Addresses 221 CVEs
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
https://github.com/eclipse-ee4j/el-ri/issues/155https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/https://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://github.com/eclipse-ee4j/el-ri/issues/155https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/https://www.oracle.com/security-alerts/cpuapr2022.html
2021-05-26
Published