Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
The software constructs all or part of an expression language (EL) statement in a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2017.
Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.
This view (slice) covers all the elements in CWE.
CWE identifiers in this view are weaknesses that do not have associated Software Fault Patterns (SFPs), as covered by the CWE-888 view. As such, they represent gaps in...
This view (slice) lists weaknesses that can be introduced during implementation.