{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.0.1-b12"}],"component":"org.glassfish:javax.el","cve_ids":["CVE-2021-28170"],"ecosystem":"Maven","epss":0.02132,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-v6w3-2prq-h95f","id":"tcs_01M5N9DEVFV6SAV6SGET3F8NPQ","modified_at":"2025-07-01T17:04:46.695265Z","published_at":"2021-10-06T17:48:38Z","references":["https://osv.dev/vulnerability/GHSA-v6w3-2prq-h95f","https://nvd.nist.gov/vuln/detail/CVE-2021-28170","https://github.com/eclipse-ee4j/el-ri/issues/155","https://github.com/eclipse-ee4j/el-ri/pull/160/commits/b6a3943ac5fba71cbc6719f092e319caa747855b","https://github.com/eclipse-ee4j/el-ri","https://security.snyk.io/vuln/SNYK-JAVA-ORGGLASSFISH-1297098","https://security.snyk.io/vuln/SNYK-JAVA-ORGGLASSFISH-2841368","https://securitylab.github.com/advisories/GHSL-2020-021-jakarta-el","https://www.oracle.com/security-alerts/cpuapr2022.html"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-v6w3-2prq-h95f#Maven/org.glassfish:javax.el","url":"https://osv.dev/vulnerability/GHSA-v6w3-2prq-h95f"}],"summary":"Improper Input Validation in Jakarta Expression Language"}