CVE Feed

    Dashboard / CVE / CVE-2019-17091

    CVE-2019-17091

    faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

    Published:Oct 2, 2019
    Last Modified:Nov 21, 2024
    EPS:Oct 2, 2019
    EPSS Score:0.0842
    CVSS Score:6.1

    Affected Products

    Vendor
    Eclipse
    Product
    Mojarra
    Vendor
    Oracle
    Product
    Application Testing Suite
    Vendor
    Oracle
    Product
    Banking Enterprise Product Manufacturing
    Vendor
    Oracle
    Product
    Communications Diameter Signaling Router
    Vendor
    Oracle
    Product
    Communications Network Integrity
    Vendor
    Oracle
    Product
    Communications Unified Inventory Management
    Vendor
    Oracle
    Product
    Enterprise Data Quality
    Vendor
    Oracle
    Product
    Health Sciences Information Manager
    Vendor
    Oracle
    Product
    Healthcare Data Repository
    Vendor
    Oracle
    Product
    Mojarra Javaserver Faces
    Vendor
    Oracle
    Product
    Primavera P6 Enterprise Project Portfolio Management
    Vendor
    Oracle
    Product
    Rapid Planning
    Vendor
    Oracle
    Product
    Retail Advanced Inventory Planning
    Vendor
    Oracle
    Product
    Retail Assortment Planning
    Vendor
    Oracle
    Product
    Retail Bulk Data Integration
    Vendor
    Oracle
    Product
    Retail Financial Integration
    Vendor
    Oracle
    Product
    Retail Integration Bus
    Vendor
    Oracle
    Product
    Retail Invoice Matching
    Vendor
    Oracle
    Product
    Retail Merchandising System
    Vendor
    Oracle
    Product
    Retail Service Backbone
    Vendor
    Oracle
    Product
    Retail Store Inventory Management
    Vendor
    Oracle
    Product
    Secure Global Desktop
    Vendor
    Oracle
    Product
    Time And Labor

    Exploits

    https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txthttps://bugs.eclipse.org/bugs/show_bug.cgi?id=548244https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt

    References

    https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244
    https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee
    https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f
    https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE
    https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt
    https://github.com/eclipse-ee4j/mojarra/issues/4556
    https://github.com/eclipse-ee4j/mojarra/pull/4567
    https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe
    https://github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4
    https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20
    https://www.oracle.com/security-alerts/cpuapr2020.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244
    https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee
    https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f
    https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE
    https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt
    https://github.com/eclipse-ee4j/mojarra/issues/4556
    https://github.com/eclipse-ee4j/mojarra/pull/4567
    https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe
    https://github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4
    https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20
    https://www.oracle.com/security-alerts/cpuapr2020.html
    https://www.oracle.com/security-alerts/cpujan2020.html
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpujan2022.html
    https://www.oracle.com/security-alerts/cpujul2020.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High