CVE-2019-17091
MEDIUM 6.1EPSS 2.5%
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v2.0 NVD
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N - EPSS
- 2.47% chance of exploitation in the next 30 days, 84th percentile
- Published
- 2019-10-02
- Updated
- 2024-08-05
Proof-of-concept exploits (2)
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244
- eclipse-ee4j/mojarra/files/3039198/advisory.txt186★ · 2026-10-13
Security advisories
- javaserverfaces/mojarra/compare/2.2.19...2.2.20
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- advisories/GHSA-rjhx-c9qh-qh8f