CVE-2019-17091
MEDIUM
6.1
CVSS Score
Published: October 2, 2019 at 01:58 PM UTC
Updated: June 17, 2026 at 02:23 AM UTC
23 products affected across 2 vendorsApplication Testing SuiteCommunications Diameter Signaling RouterCommunications Unified Inventory Management
Using N/A by N/A?
Get instant alerts when new vulnerabilities affect N/A - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.1
Exploit prediction
EPSS 2%
Description
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
2.3.0 ≤ v < 2.3.10
Affected range stops below 2.3.10, so it looks safe — our inference, not a vendor statement
8.0.0.0 ≤ v ≤ 8.4.0.5
2.2.0 ≤ v < 2.2.20
Affected range stops below 2.2.20, so it looks safe — our inference, not a vendor statement
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244
- https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee
- https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f
- https://github.com/eclipse-ee4j/mojarra/pull/4567
- https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe
References (17)
x_refsource_MISCExploitIssue TrackingPatchVendor Advisory
Source: [email protected]
https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dceex_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81fx_refsource_MISCRelease NotesThird Party Advisory
Source: [email protected]
https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASEx_refsource_MISCExploitThird Party Advisory
Source: [email protected]
https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txtx_refsource_MISCThird Party Advisory
Source: [email protected]
https://github.com/eclipse-ee4j/mojarra/issues/4556x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/eclipse-ee4j/mojarra/pull/4567x_refsource_MISCPatchThird Party Advisory
Source: [email protected]
https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27feCVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality
- LOW
- Integrity
- LOW
- Availability
- NONE
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-79
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card