The vulnerability of the faces/context/PartialViewContextImpl.java component in the Eclipse Mojarra library, which implements Mojarra JavaServer Faces and Eclipse EE4J specifications, allows attackers to perform cross-site scripting attacks.

🗓️ 19 Nov 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Vulnerability in PartialViewContextImpl.java of Mojarra permits cross site scripting.

Reporter	Title	Published	Views	Family All 26
Circl	CVE-2019-17091	9 Jan 202417:12	–	circl
CVE	CVE-2019-17091	2 Oct 201913:58	–	cve
Cvelist	CVE-2019-17091	2 Oct 201913:58	–	cvelist
Debian CVE	CVE-2019-17091	2 Oct 201913:58	–	debiancve
EUVD	EUVD-2022-5190	3 Oct 202520:07	–	euvd
Github Security Blog	Cross-site Scripting in Eclipse Mojarra	24 May 202216:57	–	github
Kaspersky	KLA11641 Multiple vulnerabilities in Oracle VirtualBox	5 Jan 202000:00	–	kaspersky
NCSC	Vulnerabilities fixed in Oracle Fusion Middleware	21 Jan 202100:00	–	ncsc
NVD	CVE-2019-17091	2 Oct 201914:15	–	nvd
Oracle	Oracle Critical Patch Update Advisory - April 2020	14 Apr 202000:00	–	oracle

Vulners

Node

oracle oracle_secure_global_desktopMatch5.4

oracle oracle_retail_merchandising_systemMatch16.0

oracle application_testing_suiteMatch13.3.0.1

eclipse eclipse_mojarraRange2.3.0–2.3.10

oracle primavera_p6_enterprise_project_portfolio_managementRange15.1.0.0–15.2.18.7

oracle primavera_p6_enterprise_project_portfolio_managementRange16.1.0.0–16.2.19.0

oracle primavera_p6_enterprise_project_portfolio_managementMatch19.12.0.0

oracle application_testing_suiteMatch13.2.0.1

oracle oracle_communications_unified_inventory_managementMatch7.3

oracle oracle_communications_unified_inventory_managementMatch7.4

oracle primavera_p6_enterprise_project_portfolio_managementRange18.1.0.0–18.8.15.0

oracle primavera_p6_enterprise_project_portfolio_managementRange17.1.0.0–17.12.15.0

oracle oracle_retail_assortment_planningMatch16.0.3

oracle oracle_secure_global_desktopMatch5.5

oracle retail_integration_busMatch15.0

oracle retail_integration_busMatch16.0

oracle banking_enterprise_product_manufacturingMatch2.7.0

oracle banking_enterprise_product_manufacturingMatch2.8.0

oracle oracle_retail_assortment_planningMatch15.0

oracle oracle_retail_assortment_planningMatch16.0

oracle oracle_retail_financial_integrationMatch15.0

oracle oracle_retail_financial_integrationMatch16.0

oracle oracle_retail_service_backboneMatch15.0

oracle oracle_retail_service_backboneMatch16.0

oracle rapid_planningMatch12.1

oracle rapid_planningMatch12.2

oracle retail_store_inventory_managementMatch14.0.4

oracle retail_store_inventory_managementMatch14.1.3

oracle retail_store_inventory_managementMatch15.0.3

oracle retail_store_inventory_managementMatch16.0.3

oracle oracle_retail_invoice_matchingMatch16.0

oracle oracle_communications_network_integrityMatch7.3.5

oracle oracle_communications_network_integrityMatch7.3.6

oracle communications_diameter_signaling_routerRange8.0.0.0–8.4.0.5

oracle oracle_retail_bulk_data_integrationMatch16.0.3.0

oracle enterprise_data_qualityMatch12.2.1.3.0

Source	Link
oracle	www.oracle.com/technetwork/topics/security/public-vuln-to-advisory-mapping-093627.html
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-17091
bugs	www.bugs.eclipse.org/bugs/show_bug.cgi
github	www.github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee
github	www.github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f
github	www.github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE
github	www.github.com/eclipse-ee4j/mojarra/issues/4556
github	www.github.com/eclipse-ee4j/mojarra/pull/4567
github	www.github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe
github	www.github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4

25 Feb 2021 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 25.8

CVSS 36.1

EPSS0.05622