Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
WebLogic Improper Neutralization of Special Elements used in an Expression Language Statement (Expression La Vulnerability - CVE-2021-28170 - Vulnerability Database
WebLogic

WebLogic Improper Neutralization of Special Elements used in an Expression Language Statement (Expression La Vulnerability - CVE-2021-28170

Medium
Reference: CVE-2021-28170
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2021-28170
Title: WebLogic Improper Neutralization of Special Elements used in an Expression Language Statement (Expression La Vulnerability
Overview:

In the Jakarta Expression Language implementation 3.0.3 and earlier a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.