CVE-2019-17091
Cross-site Scripting in Eclipse Mojarra
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
- Record
CVE-2019-17091- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
- Record
CVE-2019-17091- Updated
- 2026-11-02
EUVDEUVD-2022-5190 No score
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
- Record
EUVD-2022-5190- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rjhx-c9qh-qh8f
Cross-site Scripting in Eclipse Mojarra
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces, allows Reflected XSS because a client window field is mishandled.
- Record
GHSA-rjhx-c9qh-qh8f- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
- Record
CVE-2019-17091- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-rjhx-c9qh-qh8f
Cross-site Scripting in Eclipse Mojarra
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces, allows Reflected XSS because a client window field is mishandled.
- Record
GHSA-rjhx-c9qh-qh8f- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
- eclipse mojarra
- oracle mojarra javaserver faces
- oracle application testing suite
- oracle banking enterprise product manufacturing
- oracle communications diameter signaling router
- oracle communications network integrity
- oracle communications unified inventory management
- oracle enterprise data quality
- oracle health sciences information manager
- oracle healthcare data repository
- oracle primavera p6 enterprise project portfolio management
- oracle rapid planning
Show 11 moreShow less
- oracle retail advanced inventory planning
- oracle retail assortment planning
- oracle retail bulk data integration
- oracle retail financial integration
- oracle retail integration bus
- oracle retail invoice matching
- oracle retail merchandising system
- oracle retail service backbone
- oracle retail store inventory management
- oracle secure global desktop
- oracle time and labor
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.glassfish:javax.facesMaven |
before 2.2.20 | 2.2.20 |
org.glassfish:jakarta.facesMaven |
before 2.3.10 | 2.3.10 |
org.glassfish:javax.facesMaven |
before 2.2.20, plus listed versions 2.0.102.0.112.0.11-012.0.11-022.0.11-03 Show 45 moreShow less2.0.72.0.82.0.92.0.9-022.0.9-052.0.9-082.1.102.1.112.1.122.1.132.1.142.1.152.1.162.1.172.1.182.1.192.1.22.1.202.1.20-022.1.20-032.1.20-042.1.20-052.1.20-062.1.20-072.1.20-082.1.20-092.1.20-102.1.20-112.1.20-122.1.20-132.1.20-142.1.20-152.1.20-162.1.212.1.222.1.232.1.242.1.252.1.262.1.272.1.282.1.292.1.29-012.1.29-022.1.29-03 |
2.2.20 |
org.glassfish:jakarta.facesMaven |
before 2.3.10, plus listed versions 2.3.9 |
2.3.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-17091 is a medium vulnerability (CVSS 6.1) in Eclipse Mojarra, published October 2, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.47%, the 84th percentile. Fixed in org.glassfish:javax.faces 2.2.20.
References
oracle.com/security-alerts/cpuapr2020.html
bugs.eclipse.org/bugs/show_bug.cgi?id=548244
github.com/eclipse-ee4j/mojarra/pull/4567
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-17091
Left out here: 97 versions. The JSON record has them.