CVE-2019-17091: eclipse mojarra Cross-site Scripting
CVSS: 6.1v3.1MediumModified
AliasesGHSA-rjhx-c9qh-qh8f
Published 02-10-2019Last modified 05-08-2024
Vulnerability summary
CVE-2019-17091 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in eclipse mojarra. EPSS estimates a 2.47% chance of exploitation in the next 30 days, higher than 84.2% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
6.1/10
010
Medium · v3.1 (NVD)EPSS score
2.47%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2github, reference
Timeline
- 02-10-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 6.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 2 agree
- OSV · MavenEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.47%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.47% on 18-09-2026
18-09-202618-10-2026
EPSS score2.47%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundMojarra
Maturity: poc
Exploit Reference (bugs.eclipse.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Oracle22 products
- application_testing_suite13.2.0.1 | 13.3.0.1
- banking_enterprise_product_manufacturing2.7.0 | 2.8.0
- communications_diameter_signaling_router≥ 8.0.0.0, ≤ 8.4.0.5
- communications_network_integrity7.3.5 | 7.3.6
- communications_unified_inventory_management7.3.0 | 7.4.0
Org.glassfish2 products
- jakarta.faces< 2.3.10
- javax.faces< 2.2.20
Eclipse1 product
- mojarra≥ 2.3.0, < 2.3.10
3 vendors · 25 products
References
18 links- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCPatchThird Party Advisory
- bugs.eclipse.org/bugs/show_bug.cgi?id=548244X Refsource MISCWEBExploitIssue TrackingPatchVendor Advisory
- github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txtX Refsource MISCWEBExploitThird Party Advisory
- github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASEX Refsource MISCWEBRelease NotesThird Party Advisory
- github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dceeX Refsource MISCWEBPatchThird Party Advisory
Show all 18 references
- github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81fX Refsource MISCWEBPatchThird Party Advisory
- github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20X Refsource MISCWEBPatchThird Party Advisory
- github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27feX Refsource MISCPatchThird Party Advisory
- github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4X Refsource MISCPatchThird Party Advisory
