CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

BaseIncomplete

Description

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Frameworks such as Java Server Page (JSP) allow a developer to insert executable expressions within otherwise-static content. When the developer is not aware of the executable nature of these expressions and/or does not disable them, then if an attacker can inject expressions, this could lead to code execution or other unexpected behaviors.

Hierarchy (View 1000)

Parents

CWE-77

Children

none

CVEs mapped to this weakness (211)

page 6 of 11

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2020-7174	HPE Intelligent Management Center	Hig	0.57	8.8	0.03	Oct 19, 2020	A soapconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
CVE-2020-7173	HPE Intelligent Management Center	Hig	0.57	8.8	0.03	Oct 19, 2020	A actionselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
CVE-2019-11986	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11985	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11969	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11965	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11964	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11963	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11962	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11961	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11960	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11959	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11958	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11955	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11954	HPE Intelligent Management Center	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11953	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11952	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11951	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-5389	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-5388	HPE Intelligent Management Center (iMC) PLAT	Hig	0.57	8.8	0.04	Jun 5, 2019	A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

CVE-2020-7174HigOct 19, 2020
HPE
Intelligent Management Center
risk 0.57cvss 8.8epss 0.03
A soapconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
CVE-2020-7173HigOct 19, 2020
HPE
Intelligent Management Center
risk 0.57cvss 8.8epss 0.03
A actionselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).
CVE-2019-11986HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11985HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11969HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11965HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11964HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11963HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11962HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11961HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11960HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11959HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11958HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11955HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11954HigJun 5, 2019
HPE
Intelligent Management Center
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11953HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11952HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11951HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-5389HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-5388HigJun 5, 2019
HPE
Intelligent Management Center (iMC) PLAT
risk 0.57cvss 8.8epss 0.04
A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.