NetSight
IP …
medium6.1

CVE-2019-17091

Cross-site Scripting in Eclipse Mojarra

Impact

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces, allows Reflected XSS because a client window field is mishandled.

Affected packages

EcosystemPackageAffectedFixed in
mavenorg.glassfish:javax.faces< 2.2.202.2.20
mavenorg.glassfish:jakarta.faces< 2.3.102.3.10

Affected products

VendorProductAffected versions
EclipseMojarra
from 2.3.0 before 2.3.10
OracleMojarra Javaserver Faces
from 2.2.0 before 2.2.20
OracleApplication Testing Suite
Versions 13.2.0.1, 13.3.0.1
OracleBanking Enterprise Product Manufacturing
Versions 2.7.0, 2.8.0
OracleCommunications Diameter Signaling Router
from 8.0.0.0 through 8.4.0.5
OracleCommunications Network Integrity
Versions 7.3.5, 7.3.6
OracleCommunications Unified Inventory Management
Versions 7.3.0, 7.4.0
OracleEnterprise Data Quality
Version 12.2.1.3.0
OracleHealth Sciences Information Manager
Version 3.0
OracleHealthcare Data Repository
Version 7.0
OraclePrimavera P6 Enterprise Project Portfolio Management
from 15.1.0.0 through 15.2.18.7
from 16.1.0.0 through 16.2.19.0
from 17.1.0.0 through 17.12.15.0
from 18.1.0.0 through 18.8.15.0
Version 19.12.0.0
OracleRapid Planning
Versions 12.1, 12.2

Weakness classification

CWE-79

References