What’s Vulnerable › Vulnerabilities

CVE-2019-17091

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-10-02 · updated 2026-06-17
• Weakness: CWE-79

Description

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

Affected products

• Eclipse Foundation Eclipse Mojarra: from 2.3.0 before 2.3.10 — fixed in 2.3.10
• Oracle Corporation Oracle Application Testing Suite: 13.2.0.1, 13.3.0.1
• Oracle Banking Enterprise Product Manufacturing: 2.7.0, 2.8.0
• Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.0.0.0 through 8.4.0.5
• Oracle Communications Network Integrity: 7.3.5, 7.3.6
• Oracle Corporation Oracle Communications Unified Inventory Management: 7.3.0, 7.4.0
• Oracle Corporation Enterprise Data Quality: 12.2.1.3.0
• Oracle Health Sciences Information Manager: 3.0
• Oracle Healthcare Data Repository: 7.0
• Oracle Mojarra Javaserver Faces: from 2.2.0 before 2.2.20 — fixed in 2.2.20
• Oracle Corporation Primavera P6 Enterprise Project Portfolio Management: from 15.1.0.0 through 15.2.18.7; from 16.1.0.0 through 16.2.19.0; from 17.1.0.0 through 17.12.15.0; from 18.1.0.0 through 18.8.15.0; 19.12.0.0
• Oracle Corporation Rapid Planning: 12.1, 12.2
• Oracle Retail Advanced Inventory Planning: 15.0, 16.0
• Oracle Retail Assortment Planning: 16.0.3
• Oracle Corporation Retail Bulk Data Integration: 16.0.3.0
• Oracle Retail Financial Integration: 15.0, 16.0
• Oracle Corporation Oracle Retail Integration Bus: 15.0, 16.0
• Oracle Corporation Retail Invoice Matching: 16.0
• Oracle Corporation Retail Merchandising System: 16.0
• Oracle Retail Service Backbone: 15.0, 16.0
• Oracle Corporation Retail Store Inventory Management: 14.0.4, 14.1.3, 15.0.3, 16.0.3
• Oracle Corporation Secure Global Desktop: 5.4, 5.5
• Oracle Corporation Oracle Time and Labor: from 12.2.6 through 12.2.11

How to fix

Upgrade to a fixed version: Eclipse Foundation Eclipse Mojarra 2.3.10; Oracle Mojarra Javaserver Faces 2.2.20. Check the vendor advisory for mitigations.

References

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244
• https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee
• https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f
• https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE
• https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt
• https://github.com/eclipse-ee4j/mojarra/issues/4556
• https://github.com/eclipse-ee4j/mojarra/pull/4567
• https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe
• https://github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4
• https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://www.oracle.com/security-alerts/cpujan2020.html

Get alerted when CVE-2019-17091 or the next vulnerability affects your stack