Medium 6.1HealthcarePublished Oct 2, 2019

CVE-2019-17091faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client windo…

Updated under an hour ago (2026-10-19 09:00 UTC)

Does this affect you?

It affects eclipse mojarra and 22 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 2.47%, higher than 84% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for eclipse mojarra

Exploited in the last 30 days

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

CVSS: 6.1 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 2.47% (percentile 84)
Assigned by: mitre
NVD analysis: Modified
Record last updated: Aug 5, 2024
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

eclipse mojarra eclipse:mojarra	from 2.3.0 before 2.3.10	NVD
oracle mojarra_javaserver_faces oracle:mojarra_javaserver_faces	from 2.2.0 before 2.2.20	NVD
oracle application_testing_suite oracle:application_testing_suite	13.2.0.1; 13.3.0.1	NVD
oracle banking_enterprise_product_manufacturing oracle:banking_enterprise_product_manufacturing	2.7.0; 2.8.0	NVD
oracle communications_diameter_signaling_router oracle:communications_diameter_signaling_router	from 8.0.0.0 through 8.4.0.5	NVD
oracle communications_network_integrity oracle:communications_network_integrity	7.3.5; 7.3.6	NVD
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management	7.3.0; 7.4.0	NVD
oracle enterprise_data_quality oracle:enterprise_data_quality	12.2.1.3.0	NVD
oracle health_sciences_information_manager oracle:health_sciences_information_manager	3.0	NVD
oracle healthcare_data_repository oracle:healthcare_data_repository	7.0	NVD
oracle primavera_p6_enterprise_project_portfolio_management oracle:primavera_p6_enterprise_project_portfolio_management	from 15.1.0.0 through 15.2.18.7; from 16.1.0.0 through 16.2.19.0; from 17.1.0.0 through 17.12.15.0; from 18.1.0.0 through 18.8.15.0; 19.12.0.0	NVD
oracle rapid_planning oracle:rapid_planning	12.1; 12.2	NVD
oracle retail_advanced_inventory_planning oracle:retail_advanced_inventory_planning	15.0; 16.0	NVD
oracle retail_assortment_planning oracle:retail_assortment_planning	16.0.3	NVD
oracle retail_bulk_data_integration oracle:retail_bulk_data_integration	16.0.3.0	NVD
oracle retail_financial_integration oracle:retail_financial_integration	15.0; 16.0	NVD
oracle retail_integration_bus oracle:retail_integration_bus	15.0; 16.0	NVD
oracle retail_invoice_matching oracle:retail_invoice_matching	16.0	NVD
oracle retail_merchandising_system oracle:retail_merchandising_system	16.0	NVD
oracle retail_service_backbone oracle:retail_service_backbone	15.0; 16.0	NVD
oracle retail_store_inventory_management oracle:retail_store_inventory_management	14.0.4; 14.1.3; 15.0.3; 16.0.3	NVD
oracle secure_global_desktop oracle:secure_global_desktop	5.4; 5.5	NVD
oracle time_and_labor oracle:time_and_labor	from 12.2.6 through 12.2.11	NVD

References

https://www.oracle.com/security-alerts/cpuapr2020.htmlx-refsource-misc, patch, third-party-advisory
https://www.oracle.com/security-alerts/cpujul2020.htmlx-refsource-misc, patch, third-party-advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlx-refsource-misc, patch, third-party-advisory
https://www.oracle.com/security-alerts/cpujan2020.htmlx-refsource-misc, patch, third-party-advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244x-refsource-misc, exploit, issue-tracking, patch, vendor-advisory
https://github.com/eclipse-ee4j/mojarra/pull/4567x-refsource-misc, patch, third-party-advisory
https://github.com/eclipse-ee4j/mojarra/issues/4556x-refsource-misc, third-party-advisory
https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txtx-refsource-misc, exploit, third-party-advisory
https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASEx-refsource-misc, release-notes, third-party-advisory
https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dceex-refsource-misc, patch, third-party-advisory
https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81fx-refsource-misc, patch, third-party-advisory
https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20x-refsource-misc, patch, third-party-advisory
https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fex-refsource-misc, patch, third-party-advisory
https://github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4x-refsource-misc, patch, third-party-advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlx-refsource-misc, patch, third-party-advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlx-refsource-misc, patch, third-party-advisory
https://www.oracle.com/security-alerts/cpujan2022.htmlx-refsource-misc, patch, third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.