Back to Database
Status published
Medium
CVE-2019-17091
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse...
Vulnerability Description
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-17091
Credits & Attribution
No credits recorded in the NVD database.
References
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244
- https://github.com/eclipse-ee4j/mojarra/pull/4567
- https://github.com/eclipse-ee4j/mojarra/issues/4556
- https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt
- https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE
- https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee
- https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f
- https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20
- https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe
- https://github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
More from eclipse
View All →CVE-2023-41900
Jetty's OpenId Revoked authentication allows one request
Low
3.5
CVE-2023-40167
Jetty accepts "+" prefixed value in Content-Length
Medium
5.3
CVE-2023-36479
Jetty vulnerable to errant command quoting in CGI Servlet
Low
3.5
CVE-2023-36478
HTTP/2 HPACK integer overflow and buffer allocation
High
7.5
CVE-2023-26049
Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
Low
2.4
Affected Vendor
eclipse
View all reports →Affected Software
mojarra, mojarra javaserver faces, application testing suite, banking enterprise product manufacturing, communications diameter signaling router, communications network integrity, communications unified inventory management, enterprise data quality, health sciences information manager, healthcare data repository, primavera p6 enterprise project portfolio management, rapid planning, retail advanced inventory planning, retail assortment planning, retail bulk data integration, retail financial integration, retail integration bus, retail invoice matching, retail merchandising system, retail service backbone, retail store inventory management, secure global desktop, time and labor
Vulnerable Versions:
2.3.0, 2.2.0, 13.2.0.1, 13.3.0.1, 2.7.0, 2.8.0, 8.0.0.0, 7.3.5, 7.3.6, 7.3.0, 7.4.0, 12.2.1.3.0, 3.0, 7.0, 15.1.0.0, 16.1.0.0, 17.1.0.0, 18.1.0.0, 19.12.0.0, 12.1, 12.2, 15.0, 16.0, 16.0.3, 16.0.3.0, 14.0.4, 14.1.3, 15.0.3, 5.4, 5.5, 12.2.6
Timeline
Official Publish:
October 2nd, 2019
Last Modified:
August 5th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.