CVEvulnerability

CVE-2019-17091

6.1 MEDIUM Published 2019-10-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-10-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

Affected configurations

• eclipse mojarra (>= 2.3.0 < 2.3.10) • oracle mojarra javaserver faces (>= 2.2.0 < 2.2.20) • oracle application testing suite 13.2.0.1 • oracle application testing suite 13.3.0.1 • oracle banking enterprise product manufacturing 2.7.0 • oracle banking enterprise product manufacturing 2.8.0 • oracle communications diameter signaling router (>= 8.0.0.0 <= 8.4.0.5) • oracle communications network integrity 7.3.5 • oracle communications network integrity 7.3.6 • oracle communications unified inventory management 7.3.0 • oracle communications unified inventory management 7.4.0 • oracle enterprise data quality 12.2.1.3.0 • oracle health sciences information manager 3.0 • oracle healthcare data repository 7.0 • oracle primavera p6 enterprise project portfolio management (>= 15.1.0.0 <= 15.2.18.7) • oracle primavera p6 enterprise project portfolio management (>= 16.1.0.0 <= 16.2.19.0) • oracle primavera p6 enterprise project portfolio management (>= 17.1.0.0 <= 17.12.15.0) • oracle primavera p6 enterprise project portfolio management (>= 18.1.0.0 <= 18.8.15.0) • oracle primavera p6 enterprise project portfolio management 19.12.0.0 • oracle rapid planning 12.1 • oracle rapid planning 12.2 • oracle retail advanced inventory planning 15.0 • oracle retail advanced inventory planning 16.0 • oracle retail assortment planning 16.0.3 • oracle retail bulk data integration 16.0.3.0 • oracle retail financial integration 15.0 • oracle retail financial integration 16.0 • oracle retail integration bus 15.0 • oracle retail integration bus 16.0 • oracle retail invoice matching 16.0 • oracle retail merchandising system 16.0 • oracle retail service backbone 15.0 • oracle retail service backbone 16.0 • oracle retail store inventory management 14.0.4 • oracle retail store inventory management 14.1.3 • oracle retail store inventory management 15.0.3 • oracle retail store inventory management 16.0.3 • oracle secure global desktop 5.4 • oracle secure global desktop 5.5 • oracle time and labor (>= 12.2.6 <= 12.2.11)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References