Vulnerability Intelligence Report
CVE-2019-17091
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
No Active Exploit Signals
CVSS Base Score
6.1
MEDIUM
EPSS Probability:2.47%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| eclipse | mojarra | all |
| oracle | mojarra_javaserver_faces | all |
| oracle | application_testing_suite | 13.2.0.1, 13.3.0.1 |
| oracle | banking_enterprise_product_manufacturing | 2.7.0, 2.8.0 |
| oracle | communications_diameter_signaling_router | all |
| oracle | communications_network_integrity | 7.3.5, 7.3.6 |
| oracle | communications_unified_inventory_management | 7.3.0, 7.4.0 |
| oracle | enterprise_data_quality | 12.2.1.3.0 |
| oracle | health_sciences_information_manager | 3.0 |
| oracle | healthcare_data_repository | 7.0 |
| oracle | primavera_p6_enterprise_project_portfolio_management | 19.12.0.0 |
| oracle | rapid_planning | 12.1, 12.2 |
| oracle | retail_advanced_inventory_planning | 15.0, 16.0 |
| oracle | retail_assortment_planning | 16.0.3 |
| oracle | retail_bulk_data_integration | 16.0.3.0 |
| oracle | retail_financial_integration | 15.0, 16.0 |
| oracle | retail_integration_bus | 15.0, 16.0 |
| oracle | retail_invoice_matching | 16.0 |
| oracle | retail_merchandising_system | 16.0 |
| oracle | retail_service_backbone | 15.0, 16.0 |
| oracle | retail_store_inventory_management | 14.0.4, 14.1.3, 15.0.3, 16.0.3 |
| oracle | secure_global_desktop | 5.4, 5.5 |
| oracle | time_and_labor | all |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
2.469%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2019-10-02T00:00:00 |
| Published | 2019-10-02T13:58:49 |
| Last Updated | 2024-08-05T01:33:16 |
Community Chatter & Buzz