CVE-2021-28170 – jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate

https://notcve.org/view.php?id=CVE-2021-28170

26 May 2021 — In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid. En la implementación de Jakarta Expression Language versiones 3.0.3 y anteriores, un bug en la función ELParserTokenManager permite que las expresiones EL no válidas sean evaluadas como si fueran válidas Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This rele... • https://github.com/eclipse-ee4j/el-ri/issues/155 • CWE-20: Improper Input Validation CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •