CVE & CISA-KEV Catalog

CVE-2021-28170

MEDIUMEPSS 80th pctl

5.3

CVSS v3

Description

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.

CWE-20Improper Input Validation CWE-917

How to fix

Remediation Available

eap7-glassfish-elRocky

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-glassfish-elRed Hat / RHEL

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-glassfish-el-implRed Hat / RHEL

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-glassfish-el-implRocky

Fixed in:0:3.0.1-4.b08_redhat_00005.1.ep7.el7RHSA-2025:9582

eap7-hibernateRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernateRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-coreRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-coreRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-entitymanagerRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-entitymanagerRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-enversRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-enversRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-infinispanRed Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-infinispanRocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-java8Rocky

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-hibernate-java8Red Hat / RHEL

Fixed in:0:5.1.17-3.Final_redhat_00004.1.ep7.el7RHSA-2025:9582

eap7-jackson-databindRocky

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-jackson-databindRed Hat / RHEL

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:2.8.11.6-3.SP1_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-jboss-ejb-clientRocky

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-jboss-ejb-clientRed Hat / RHEL

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.0.12-1.Final_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-nettyRocky

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-nettyRed Hat / RHEL

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-netty-allRocky

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-netty-allRed Hat / RHEL

Fixed in:0:4.1.63-2.Final_redhat_00003.1.ep7.el7RHSA-2025:9582

eap7-undertowRocky

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-undertowRed Hat / RHEL

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.4.18-16.SP14_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildflyRocky

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildflyRed Hat / RHEL

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildfly-elytronRocky

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-elytronRed Hat / RHEL

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.1.14-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-client-commonRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-client-commonRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-ejb-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-ejb-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-naming-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-naming-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-transaction-clientRed Hat / RHEL

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-http-transaction-clientRocky

Fixed in:0:1.0.21-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-modulesRed Hat / RHEL

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildfly-modulesRocky

Fixed in:0:7.1.11-4.GA_redhat_00002.1.ep7.el7RHSA-2025:9582

eap7-wildfly-naming-clientRed Hat / RHEL

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-naming-clientRocky

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.13-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-opensslRed Hat / RHEL

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-opensslRocky

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-javaRocky

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-javaRed Hat / RHEL

Fixed in:0:1.0.12-1.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linuxRocky

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linuxRed Hat / RHEL

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linux-debuginfoRocky

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

eap7-wildfly-openssl-linux-debuginfoRed Hat / RHEL

Fixed in:0:1.0.12-6.Final_redhat_00001.1.ep7.el7RHSA-2025:9582

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploit Intelligence

2.13%probability of exploitation in 30 days

80thpercentile

Elevated risk: more likely to be exploited than 80% of all known CVEs.

References

Patch1

oracle.com

Exploit2

Related Vulnerabilities

Other CWE-20 (Improper Input Validation) vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2024-3400	Critical	10.0	100%	KEV + Ransom	-
CVE-2021-45105	Medium	5.9	100%	-	Fix
CVE-2021-44228	Critical	10.0	100%	KEV + Ransom	Fix
CVE-2021-21985	Critical	9.8	100%	KEV + Ransom	Fix
CVE-2018-7600	Critical	9.8	100%	KEV + Ransom	Fix
CVE-2020-3452	High	7.5	100%	KEV	Fix

Embed a live status badge for CVE-2021-28170

Markdown

[![CVE-2021-28170](https://tridentstack.com/cve/badge/CVE-2021-28170.svg)](https://tridentstack.com/cve/CVE-2021-28170)

HTML

<a href="https://tridentstack.com/cve/CVE-2021-28170"><img src="https://tridentstack.com/cve/badge/CVE-2021-28170.svg" alt="CVE-2021-28170"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.