Description (CNA)
In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| The Eclipse Foundation / Jakarta Expression Language Implementation | affected unspecified through 3.0.3; unknown next of 3.0.3 before unspecified |
CWE
CWE-20
References
- https://github.com/eclipse-ee4j/el-ri/issues/155
- https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el/
- https://www.oracle.com/security-alerts/cpuapr2022.html
ADP enrichment
No English description supplied.