CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
206 vulnerabilities with CWE-917
CVE-2023-26092
CRITICAL
Liima < 1.17.28 - Server-Side Template Injection
CVSS 9.8
CVE-2022-4146
HIGH
Hitachi Replication Manager <8.8.5-02 - Code Injection
CVSS 7.3
CVE-2022-45855
HIGH
Apache Ambari 2.7.0-2.7.6 - Authenticated Remote Code Execution via SpringEL Injection
CVSS 8.0
CVE-2022-42009
HIGH
Apache Ambari 2.7.0-2.7.6 - Authenticated Remote Code Execution via SpringEL Injection
CVSS 8.0
CVE-2022-23504
MEDIUM
TYPO3 < 9.5.38, 10.4.33, 11.5.20, 12.1.1 - Sensitive Information Disclosure via YAML Placeholder Expressions
CVSS 5.7
CVE-2022-23463
CRITICAL
Nepxion Discovery < 6.16.2 - Remote Code Execution via SpEL Injection in DiscoveryExpressionResolver
CVSS 9.4
CVE-2022-34466
MEDIUM
Mendix 9 >=V9.11<V9.15,Mendix 9 V9.12 <V9.12.3 - Info Disclosure
CVSS 6.5
CVE-2022-22980
CRITICAL
Spring Data MongoDB - Code Injection
CVSS 9.8
CVE-2022-26134
CRITICAL
KEV
Confluence - Remote Code Execution
CVSS 9.8
CVE-2022-26111
HIGH
IRISNext < 9.8.28 - Remote Code Execution via BeanShell Expression Injection
CVSS 8.8
CVE-2022-24847
HIGH
GeoServer < 2.19.6 and 2.20.0-2.20.4 - Authenticated Expression Language Injection via JNDI Lookup
CVSS 7.2
CVE-2022-24818
HIGH
GeoTools < 24.6 - Authenticated Expression Language Injection via JNDI Lookup
CVSS 8.2
CVE-2022-22963
CRITICAL
KEV
Spring Cloud Function < 3.1.6 - Remote Code Execution via SpEL Routing Expression
CVSS 9.8
CVE-2022-22947
CRITICAL
KEV
Spring Cloud Gateway Remote Code Execution
CVSS 10.0
CVE-2021-31805
CRITICAL
Apache Struts 2.0.0-2.5.29 - Remote Code Execution via Forced OGNL Evaluation
CVSS 9.8
CVE-2021-45046
CRITICAL
KEV
Apache Log4j < 2.12.2 - Remote Code Execution
CVSS 9.0
CVE-2021-44228
CRITICAL
KEV
Log4Shell HTTP Header Injection
CVSS 10.0
CVE-2021-32834
HIGH
Eclipse Keti - Remote Code Execution via Groovy Script Injection
CVSS 8.2
CVE-2021-26084
CRITICAL
KEV
Atlassian Confluence Server and Data Center - OGNL Injection
CVSS 9.8
CVE-2021-28170
MEDIUM
Jakarta Expression Language <3.0.3 - Info Disclosure
CVSS 5.3
CVE-2020-26565
HIGH
ObjectPlanet Opinio <7.14 - Code Injection
CVSS 7.5
CVE-2020-17530
CRITICAL
KEV
Apache Struts 2 Forced Multi OGNL Evaluation
CVSS 9.8
CVE-2020-7195
HIGH
HPE Intelligent Management Center < 7.3 - Remote Code Execution via iccselectrules Expression Language Injection
CVSS 8.8
CVE-2020-7194
HIGH
HPE Intelligent Management Center < 7.3 - Remote Code Execution via Expression Language Injection
CVSS 8.8
CVE-2020-7193
HIGH
HPE Intelligent Management Center < 7.3 - Remote Code Execution via Expression Language Injection
CVSS 8.8
Details
Vulnerabilities
206