Description

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

Remediation

References

https://github.com/eclipse-ee4j/el-ri/issues/155

https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/

https://www.oracle.com/security-alerts/cpuapr2022.html

Related Vulnerabilities

CVE-2022-30500 Vulnerability in maven package com.jflyfox:jflyfox_jfinal

CVE-2021-39148 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2021-36373 Vulnerability in maven package org.apache.ant:ant

CVE-2021-23379 Vulnerability in npm package portkiller

CVE-2020-7645 Vulnerability in npm package chrome-launcher

Severity

Medium

Classification

CWE-917 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Exploit Issue Tracking Third Party Advisory Patch