GHSA-v6w3-2prq-h95f

Suggest an improvement
Source
https://github.com/advisories/GHSA-v6w3-2prq-h95f
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/10/GHSA-v6w3-2prq-h95f/GHSA-v6w3-2prq-h95f.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-v6w3-2prq-h95f
Aliases
Published
2021-10-06T17:48:38Z
Modified
2025-07-01T16:41:01.084020Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Improper Input Validation in Jakarta Expression Language
Details

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

Database specific
{
    "cwe_ids": [
        "CWE-20",
        "CWE-917"
    ],
    "github_reviewed_at": "2021-10-06T13:31:54Z",
    "github_reviewed": true,
    "severity": "MODERATE",
    "nvd_published_at": "2021-05-26T22:15:00Z"
}
References

Affected packages

Maven / com.sun.el:el-ri

Package

Name
com.sun.el:el-ri
View open source insights on deps.dev
Purl
pkg:maven/com.sun.el/el-ri

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.4

Affected versions

1.*

1.0

Maven / org.glassfish:jakarta.el

Package

Name
org.glassfish:jakarta.el
View open source insights on deps.dev
Purl
pkg:maven/org.glassfish/jakarta.el

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.4

Affected versions

3.*

3.0.2
3.0.3

Maven / org.glassfish:javax.el

Package

Name
org.glassfish:javax.el
View open source insights on deps.dev
Purl
pkg:maven/org.glassfish/javax.el

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
3.0.1-b12

Affected versions

3.*

3.0-b01
3.0-b02
3.0-b03
3.0-b04
3.0-b05
3.0-b06
3.0-b07
3.0.0
3.0.1-b01
3.0.1-b02
3.0.1-b03
3.0.1-b04
3.0.1-b05
3.0.1-b06
3.0.1-b07
3.0.1-b08
3.0.1-b09
3.0.1-b10
3.0.1-b11
3.0.1-b12