CVE-2021-28170: eclipse jakarta_expression_language Improper Input Validation
Vulnerability summary
CVE-2021-28170 is a medium (CVSS 5.3) Improper Input Validation vulnerability in eclipse jakarta_expression_language. EPSS estimates a 2.13% chance of exploitation in the next 30 days, higher than 81.9% of scored vulnerabilities. 2 public exploits are recorded.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6Timeline
- 26-05-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
2.13%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.13% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundEl Ri
Maturity: poc
Ghsl 2020 021 Jakarta El
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-917Improper Neutralization of Special Elements used in an Expression Language StatementThe product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle2 products
- communications_cloud_native_core_policy1.14.0
- weblogic_server14.1.1.0.0
Org.glassfish2 products
- jakarta.el< 3.0.4
- javax.el≤ 3.0.1-b12
Chainguard1 product
- hadoop-fips-3.4.2All versions (No fix recorded)
Com.sun.el1 product
- el-ri< 3.0.4
Debian1 product
- jakarta-el-apiAll versions (No fix recorded)
Eclipse1 product
- jakarta_expression_language≤ 3.0.3
Quarkus1 product
- quarkus< 2.3.0
The eclipse foundation1 product
- jakarta expression language implementation≥ unspecified, ≤ 3.0.3
Ubuntu1 product
- jakarta-el-apiAll versions (No fix recorded)
9 vendors · 11 products
References
12 links- github.com/eclipse-ee4j/el-ri/issues/155X Refsource CONFIRMREPORTWEBExploitIssue TrackingThird Party Advisory
- securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/X Refsource CONFIRMREPORTEVIDENCEExploitThird Party Advisory
