{"id":"CVE-2019-17091","aliases":["EUVD-2022-5190","GHSA-rjhx-c9qh-qh8f"],"status":"published","title":"Cross-site Scripting in Eclipse Mojarra","description":"faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02469,"percentile":0.84635,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-10-02T13:58:49Z","modified":"2026-10-24T14:03:40Z","fixes":[{"ecosystem":"Maven","package":"org.glassfish:javax.faces","fixed_in":["2.2.20"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.glassfish:jakarta.faces","fixed_in":["2.3.10"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.glassfish:javax.faces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.20"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.glassfish:jakarta.faces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.glassfish:javax.faces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.20"}]}],"versions":["2.0.10","2.0.11","2.0.11-01","2.0.11-02","2.0.11-03","2.0.7","2.0.8","2.0.9","2.0.9-02","2.0.9-05","2.0.9-08","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.18","2.1.19","2.1.2","2.1.20","2.1.20-02","2.1.20-03","2.1.20-04","2.1.20-05","2.1.20-06","2.1.20-07","2.1.20-08","2.1.20-09","2.1.20-10","2.1.20-11","2.1.20-12","2.1.20-13","2.1.20-14","2.1.20-15","2.1.20-16","2.1.21","2.1.22","2.1.23","2.1.24","2.1.25","2.1.26","2.1.27","2.1.28","2.1.29","2.1.29-01","2.1.29-02","2.1.29-03","2.1.29-04","2.1.29-05","2.1.29-06","2.1.29-07","2.1.29-08","2.1.29-09","2.1.29-10","2.1.29-11","2.1.3","2.1.4","2.1.5","2.1.5-02","2.1.5-04","2.1.6","2.1.7","2.1.7-01","2.1.7-02","2.1.7-03","2.1.7-04","2.1.7-05","2.1.7-06","2.1.7-07","2.1.7-08","2.1.7-09","2.1.7-10","2.1.8","2.1.9","2.2.0","2.2.0-m01","2.2.0-m02","2.2.0-m03","2.2.0-m04","2.2.0-m05","2.2.0-m06","2.2.0-m07","2.2.0-m08","2.2.0-m09","2.2.0-m10","2.2.0-m11","2.2.0-m12","2.2.0-m13","2.2.0-m14","2.2.0-m15","2.2.1","2.2.10","2.2.11","2.2.12","2.2.13","2.2.14","2.2.15","2.2.16","2.2.17","2.2.18","2.2.19","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.8-01","2.2.8-02","2.2.8-03","2.2.8-04","2.2.8-05","2.2.8-06","2.2.8-07","2.2.8-08","2.2.8-09","2.2.8-10","2.2.8-11","2.2.8-12","2.2.8-13","2.2.8-14","2.2.8-15","2.2.8-16","2.2.8-17","2.2.8-18","2.2.8-19","2.2.8-20","2.2.8-21","2.2.8-22","2.2.8-23","2.2.8-24","2.2.8-25","2.2.8-26","2.2.8-27","2.2.8-28","2.2.8-29","2.2.8-30","2.2.8-31","2.2.8-32","2.2.8-33","2.2.8-34","2.2.8-35","2.2.9"]},{"source":"osv","ecosystem":"Maven","package":"org.glassfish:jakarta.faces","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10"}]}],"versions":["2.3.9"]}],"products":[{"vendor":"eclipse","product":"mojarra"},{"vendor":"oracle","product":"application_testing_suite"},{"vendor":"oracle","product":"banking_enterprise_product_manufacturing"},{"vendor":"oracle","product":"communications_diameter_signaling_router"},{"vendor":"oracle","product":"communications_network_integrity"},{"vendor":"oracle","product":"communications_unified_inventory_management"},{"vendor":"oracle","product":"enterprise_data_quality"},{"vendor":"oracle","product":"health_sciences_information_manager"},{"vendor":"oracle","product":"healthcare_data_repository"},{"vendor":"oracle","product":"mojarra_javaserver_faces"},{"vendor":"oracle","product":"primavera_p6_enterprise_project_portfolio_management"},{"vendor":"oracle","product":"rapid_planning"},{"vendor":"oracle","product":"retail_advanced_inventory_planning"},{"vendor":"oracle","product":"retail_assortment_planning"},{"vendor":"oracle","product":"retail_bulk_data_integration"},{"vendor":"oracle","product":"retail_financial_integration"},{"vendor":"oracle","product":"retail_integration_bus"},{"vendor":"oracle","product":"retail_invoice_matching"},{"vendor":"oracle","product":"retail_merchandising_system"},{"vendor":"oracle","product":"retail_service_backbone"},{"vendor":"oracle","product":"retail_store_inventory_management"},{"vendor":"oracle","product":"secure_global_desktop"},{"vendor":"oracle","product":"time_and_labor"}],"references":[{"url":"https://www.oracle.com/security-alerts/cpuapr2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/security-alerts/cpujul2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/security-alerts/cpujan2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","fix","web"]},{"url":"https://github.com/eclipse-ee4j/mojarra/pull/4567","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/eclipse-ee4j/mojarra/issues/4556","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17091","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rjhx-c9qh-qh8f"}],"sources":{"cve":[{"id":"CVE-2019-17091","description":"faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.","status":"published","published":"2019-10-02T13:58:49Z","modified":"2024-08-05T01:33:16.741Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2022-5190","description":"faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.","status":"published","published":"2019-10-02T13:58:49Z","modified":"2024-08-05T01:33:16Z","updated_at":"2026-11-03T02:40:30.885546Z"}],"ghsa":[{"id":"GHSA-rjhx-c9qh-qh8f","title":"Cross-site Scripting in Eclipse Mojarra","description":"faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces, allows Reflected XSS because a client window field is mishandled.","status":"published","published":"2022-05-24T16:57:42Z","modified":"2023-02-01T05:04:18Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:32.120868Z"}],"nvd":[{"id":"CVE-2019-17091","description":"faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.","status":"published","published":"2019-10-02T14:15:12.6Z","modified":"2026-06-17T02:23:17.263Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:31.019577Z"}],"osv":[{"id":"CVE-2019-17091","description":"faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.","status":"published","published":"2019-10-02T14:15:12.6Z","modified":"2026-10-24T14:03:40.171689475Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"GHSA-rjhx-c9qh-qh8f","title":"Cross-site Scripting in Eclipse Mojarra","description":"faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces, allows Reflected XSS because a client window field is mishandled.","status":"published","published":"2022-05-24T16:57:42Z","modified":"2023-11-08T04:01:22.637374Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:55.877614Z"}]}}