Lucene search

[email protected]CVE-2019-17091

HistoryOct 02, 2019 - 2:15 p.m.

CVE-2019-17091

2019-10-0214:15:12

CWE-79

[email protected]

web.nvd.nist.gov

105

cve-2019-17091

reflected xss

mojarra

eclipse

nvd

security vulnerability

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.1%

JSON

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

Affected configurations

NVD

Node

eclipsemojarraRange2.3.0–2.3.10

oraclemojarra_javaserver_facesRange2.2.0–2.2.20

Node

oracleapplication_testing_suiteMatch13.2.0.1

oracleapplication_testing_suiteMatch13.3.0.1

oraclebanking_enterprise_product_manufacturingMatch2.7.0

oraclebanking_enterprise_product_manufacturingMatch2.8.0

oraclecommunications_diameter_signaling_routerRange8.0.0.0–8.4.0.5

oraclecommunications_network_integrityMatch7.3.5

oraclecommunications_network_integrityMatch7.3.6

oraclecommunications_unified_inventory_managementMatch7.3.0

oraclecommunications_unified_inventory_managementMatch7.4.0

oracleenterprise_data_qualityMatch12.2.1.3.0

oraclehealth_sciences_information_managerMatch3.0

oraclehealthcare_data_repositoryMatch7.0

oracleprimavera_p6_enterprise_project_portfolio_managementRange15.1.0.0–15.2.18.7

oracleprimavera_p6_enterprise_project_portfolio_managementRange16.1.0.0–16.2.19.0

oracleprimavera_p6_enterprise_project_portfolio_managementRange17.1.0.0–17.12.15.0

oracleprimavera_p6_enterprise_project_portfolio_managementRange18.1.0.0–18.8.15.0

oracleprimavera_p6_enterprise_project_portfolio_managementMatch19.12.0.0

oraclerapid_planningMatch12.1

oraclerapid_planningMatch12.2

oracleretail_advanced_inventory_planningMatch15.0

oracleretail_advanced_inventory_planningMatch16.0

oracleretail_assortment_planningMatch16.0.3

oracleretail_bulk_data_integrationMatch16.0.3.0

oracleretail_financial_integrationMatch15.0

oracleretail_financial_integrationMatch16.0

oracleretail_integration_busMatch15.0

oracleretail_integration_busMatch16.0

oracleretail_invoice_matchingMatch16.0

oracleretail_merchandising_systemMatch16.0

oracleretail_service_backboneMatch15.0

oracleretail_service_backboneMatch16.0

oracleretail_store_inventory_managementMatch14.0.4

oracleretail_store_inventory_managementMatch14.1.3

oracleretail_store_inventory_managementMatch15.0.3

oracleretail_store_inventory_managementMatch16.0.3

oraclesecure_global_desktopMatch5.4

oraclesecure_global_desktopMatch5.5

oracletime_and_laborRange12.2.6–12.2.11

CPENameOperatorVersion
eclipse:mojarraeclipse mojarralt2.3.10
oracle:mojarra_javaserver_facesoracle mojarra javaserver faceslt2.2.20

CPE	Name	Operator	Version
eclipse:mojarra	eclipse mojarra	lt	2.3.10
oracle:mojarra_javaserver_faces	oracle mojarra javaserver faces	lt	2.2.20

References

bugs.eclipse.org/bugs/show_bug.cgi?id=548244

github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee

github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f

github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE

github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt

github.com/eclipse-ee4j/mojarra/issues/4556

github.com/eclipse-ee4j/mojarra/pull/4567

github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe

github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4

github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20

www.oracle.com/security-alerts/cpuapr2020.html

www.oracle.com/security-alerts/cpujan2020.html

www.oracle.com/security-alerts/cpujan2021.html

www.oracle.com/security-alerts/cpujan2022.html

www.oracle.com/security-alerts/cpujul2020.html

www.oracle.com/security-alerts/cpuoct2020.html

www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.4 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

56.1%

JSON

Related for CVE-2019-17091

prion1 cvelist1 debiancve1 osv2 symantec1 nvd1 github1 nessus4 kaspersky1 oracle8