CVE-2019-17091
Summary
| CVE | CVE-2019-17091 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-10-02 14:15:00 UTC |
| Updated | 2022-04-06 18:00:00 UTC |
| Description | faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled. |
Risk And Classification
Problem Types: CWE-79
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 548244 – Vulnerability within Oracle Mojarra JSF v2.2 and v2.3 | MISC | bugs.eclipse.org | Exploit, Issue Tracking, Patch, Vendor Advisory |
| HIGH-LEVEL VULNERABILITY WITHIN MOJARRA JSF V2.2 · Issue #4556 · eclipse-ee4j/mojarra · GitHub | MISC | github.com | Third Party Advisory |
| Merge pull request #4567 from ruolli/Issue_4556 · eclipse-ee4j/mojarra@8f70f2b · GitHub | MISC | github.com | Patch, Third Party Advisory |
| github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt | MISC | github.com | Exploit, Third Party Advisory |
| Fixes #4556 : HIGH-LEVEL VULNERABILITY WITHIN MOJARRA JSF V2.2 · eclipse-ee4j/mojarra@a3fa957 · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Oracle Critical Patch Update Advisory - July 2020 | MISC | www.oracle.com | |
| Comparing 2.3.9-RELEASE...2.3.10-RELEASE · eclipse-ee4j/mojarra · GitHub | MISC | github.com | Release Notes, Third Party Advisory |
| Oracle Critical Patch Update Advisory - October 2020 | MISC | www.oracle.com | |
| Bug 29700737 - XSS VULNERABILITY IN MOJARRA CLIENTWINDOW URL PARAMETER · javaserverfaces/mojarra@ae1c234 · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Oracle Critical Patch Update Advisory - January 2022 | MISC | www.oracle.com | |
| Fixes #4556 : HIGH-LEVEL VULNERABILITY WITHIN MOJARRA JSF V2.2 by ruolli · Pull Request #4567 · eclipse-ee4j/mojarra · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Bug 29700737 - XSS VULNERABILITY IN MOJARRA CLIENTWINDOW URL PARAMETER · javaserverfaces/mojarra@f61935c · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Oracle Critical Patch Update - October 2019 | MISC | www.oracle.com | Third Party Advisory |
| Oracle Critical Patch Update Advisory - January 2020 | MISC | www.oracle.com | |
| Oracle Critical Patch Update Advisory - April 2020 | N/A | www.oracle.com | |
| Oracle Critical Patch Update Advisory - January 2021 | MISC | www.oracle.com | |
| Comparing 2.2.19...2.2.20 · javaserverfaces/mojarra · GitHub | MISC | github.com | Patch, Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.