Cross-site Scripting in Eclipse Mojarra

보통 6.1CVE-2019-17091 · GHSA-rjhx-c9qh-qh8f · Published 02/10/2019 · updated 17/06/2026

요약

CVE-2019-17091은(는) org.glassfish:jakarta.faces, org.glassfish:javax.faces, mojarra (eclipse)에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 2.5%, 전체 취약점의 84.5%보다 높음.
조치: 2.3.10, 2.2.20 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
org.glassfish:jakarta.faces Maven	`< 2.3.10`	`2.3.10`
org.glassfish:javax.faces Maven	`< 2.2.20`	`2.2.20`
mojarra eclipse	`≥ 2.3.0, < 2.3.10`	`2.3.10`
application testing suite oracle	`= 13.2.0.1= 13.3.0.1`	No fix yet
banking enterprise product manufacturing oracle	`= 2.7.0= 2.8.0`	No fix yet
communications diameter signaling router oracle	`≥ 8.0.0.0, ≤ 8.4.0.5`	No fix yet
communications network integrity oracle	`= 7.3.5= 7.3.6`	No fix yet
communications unified inventory management oracle	`= 7.3.0= 7.4.0`	No fix yet
enterprise data quality oracle	`= 12.2.1.3.0`	No fix yet
health sciences information manager oracle	`= 3.0`	No fix yet
healthcare data repository oracle	`= 7.0`	No fix yet
mojarra javaserver faces oracle	`≥ 2.2.0, < 2.2.20`	`2.2.20`
primavera p6 enterprise project portfolio management oracle	`= 19.12.0.0≥ 15.1.0.0, ≤ 15.2.18.7≥ 16.1.0.0, ≤ 16.2.19.0≥ 17.1.0.0, ≤ 17.12.15.0≥ 18.1.0.0, ≤ 18.8.15.0`	No fix yet
rapid planning oracle	`= 12.1= 12.2`	No fix yet
retail advanced inventory planning oracle	`= 15.0= 16.0`	No fix yet
retail assortment planning oracle	`= 16.0.3`	No fix yet
retail bulk data integration oracle	`= 16.0.3.0`	No fix yet
retail financial integration oracle	`= 15.0= 16.0`	No fix yet
retail integration bus oracle	`= 15.0= 16.0`	No fix yet
retail invoice matching oracle	`= 16.0`	No fix yet
retail merchandising system oracle	`= 16.0`	No fix yet
retail service backbone oracle	`= 15.0= 16.0`	No fix yet
retail store inventory management oracle	`= 14.0.4= 14.1.3= 15.0.3= 16.0.3`	No fix yet
secure global desktop oracle	`= 5.4= 5.5`	No fix yet
time and labor oracle	`≥ 12.2.6, ≤ 12.2.11`	No fix yet

Description

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces, allows Reflected XSS because a client window field is mishandled.

NVD description

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

References

nvd.nist.gov/vuln/detail/CVE-2019-17091 · ADVISORY
eclipse-ee4j/mojarra · WEB
eclipse-ee4j/mojarra#4567 · WEB
eclipse-ee4j/mojarra commit 8f70f2b · WEB
eclipse-ee4j/mojarra commit a3fa957 · WEB
bugs.eclipse.org/bugs/show_bug.cgi · WEB
eclipse-ee4j/mojarra · WEB
eclipse-ee4j/mojarra · WEB
javaserverfaces/mojarra · WEB
javaserverfaces/mojarra commit ae1c234 · Patch
javaserverfaces/mojarra commit f61935c · Patch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free