CVE-2019-17091

Published: Oct 2, 2019Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

Affected (40)

Products: Eclipse: Mojarra · Oracle: Mojarra Javaserver Faces, Application Testing Suite, Banking Enterprise Product Manufacturing, Communications Diameter Signaling Router, Communications Network Integrity, Communications Unified Inventory Management, Enterprise Data Quality, Health Sciences Information Manager, Healthcare Data Repository, Primavera P6 Enterprise Project Portfolio Management, Rapid Planning, Retail Advanced Inventory Planning, Retail Assortment Planning, Retail Bulk Data Integration, Retail Financial Integration, Retail Integration Bus, Retail Invoice Matching, Retail Merchandising System, Retail Service Backbone, Retail Store Inventory Management, Secure Global Desktop, Time And Labor

Eclipse

1 product

Mojarra

Oracle

22 products

Mojarra Javaserver Faces

Application Testing Suite

Banking Enterprise Product Manufacturing

Communications Diameter Signaling Router

Communications Network Integrity

Communications Unified Inventory Management

Enterprise Data Quality

Health Sciences Information Manager

Healthcare Data Repository

Primavera P6 Enterprise Project Portfolio Management

Rapid Planning

Retail Advanced Inventory Planning

Retail Assortment Planning

Retail Bulk Data Integration

Retail Financial Integration

Retail Integration Bus

Retail Invoice Matching

Retail Merchandising System

Retail Service Backbone

Retail Store Inventory Management

Secure Global Desktop

Time And Labor

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Eclipse Mojarra	From 2.3.0 to 2.3.10
Oracle Mojarra Javaserver Faces	From 2.2.0 to 2.2.20

Configuration B

38 vulnerable

Vulnerable Software	Affected Versions
Oracle Application Testing Suite	Version 13.2.0.1
Oracle Application Testing Suite	Version 13.3.0.1
Oracle Banking Enterprise Product Manufacturing	Version 2.7.0
Oracle Banking Enterprise Product Manufacturing	Version 2.8.0
Oracle Communications Diameter Signaling Router	From 8.0.0.0 to 8.4.0.5
Oracle Communications Network Integrity	Version 7.3.5
Oracle Communications Network Integrity	Version 7.3.6
Oracle Communications Unified Inventory Management	Version 7.3.0
Oracle Communications Unified Inventory Management	Version 7.4.0
Oracle Enterprise Data Quality	Version 12.2.1.3.0
Oracle Health Sciences Information Manager	Version 3.0
Oracle Healthcare Data Repository	Version 7.0
Oracle Primavera P6 Enterprise Project Portfolio Management	From 15.1.0.0 to 15.2.18.7
Oracle Primavera P6 Enterprise Project Portfolio Management	From 16.1.0.0 to 16.2.19.0
Oracle Primavera P6 Enterprise Project Portfolio Management	From 17.1.0.0 to 17.12.15.0
Oracle Primavera P6 Enterprise Project Portfolio Management	From 18.1.0.0 to 18.8.15.0
Oracle Primavera P6 Enterprise Project Portfolio Management	Version 19.12.0.0
Oracle Rapid Planning	Version 12.1
Oracle Rapid Planning	Version 12.2
Oracle Retail Advanced Inventory Planning	Version 15.0
Oracle Retail Advanced Inventory Planning	Version 16.0
Oracle Retail Assortment Planning	Version 16.0.3
Oracle Retail Bulk Data Integration	Version 16.0.3.0
Oracle Retail Financial Integration	Version 15.0
Oracle Retail Financial Integration	Version 16.0
Oracle Retail Integration Bus	Version 15.0
Oracle Retail Integration Bus	Version 16.0
Oracle Retail Invoice Matching	Version 16.0
Oracle Retail Merchandising System	Version 16.0
Oracle Retail Service Backbone	Version 15.0
Oracle Retail Service Backbone	Version 16.0
Oracle Retail Store Inventory Management	Version 14.0.4
Oracle Retail Store Inventory Management	Version 14.1.3
Oracle Retail Store Inventory Management	Version 15.0.3
Oracle Retail Store Inventory Management	Version 16.0.3
Oracle Secure Global Desktop	Version 5.4
Oracle Secure Global Desktop	Version 5.5
Oracle Time And Labor	From 12.2.6 to 12.2.11

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (34)

https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244

Source: cve@mitre.org

ExploitIssue TrackingPatchVendor Advisory

https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE

Source: cve@mitre.org

Release NotesThird Party Advisory

https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/eclipse-ee4j/mojarra/issues/4556

Source: cve@mitre.org

Third Party Advisory

https://github.com/eclipse-ee4j/mojarra/pull/4567

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: cve@mitre.org

PatchThird Party Advisory

https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244