CVE-2019-17091

MEDIUM

Eclipse Mojarra 2.3.0-2.3.9 - Reflected Cross-Site Scripting in PartialViewContextImpl

Title source: llm
STIX 2.1

Description

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

References (17)

Core 17
Core References
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2020.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujul2020.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2020.html
Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_misc
https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244
Patch, Third Party Advisory x_refsource_misc
https://github.com/eclipse-ee4j/mojarra/pull/4567
Third Party Advisory x_refsource_misc
https://github.com/eclipse-ee4j/mojarra/issues/4556
Exploit, Third Party Advisory x_refsource_misc
https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE
Patch, Third Party Advisory x_refsource_misc
https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuoct2020.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2021.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html

Scores

CVSS v3 6.1
EPSS 0.0562
EPSS Percentile 90.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (39)
eclipse/mojarra 2.3.0 - 2.3.10
oracle/application_testing_suite 13.2.0.1
oracle/application_testing_suite 13.3.0.1
oracle/banking_enterprise_product_manufacturing 2.7.0
oracle/banking_enterprise_product_manufacturing 2.8.0
oracle/communications_diameter_signaling_router 8.0.0.0 - 8.4.0.5
oracle/communications_network_integrity 7.3.5
oracle/communications_network_integrity 7.3.6
oracle/communications_unified_inventory_management 7.3.0
oracle/communications_unified_inventory_management 7.4.0
... and 29 more
Published Oct 02, 2019
Tracked Since Feb 18, 2026