Read the docs
TI-2019-12748 Aliases CVE-2019-17091GHSA-rjhx-c9qh-qh8f

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for…

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

Why it matters now

EPSS 0.02469 84th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed org.glassfish:javax.faces (Maven): 2.2.20org.glassfish:jakarta.faces (Maven): 2.3.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.glassfish:javax.faces (Maven)before 2.2.202.2.20Patch availableGHSA-rjhx-c9qh-qh8f
—org.glassfish:jakarta.faces (Maven)before 2.3.102.3.10Patch availableGHSA-rjhx-c9qh-qh8f
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.glassfish:javax.faces (Maven) Vendor— Affected before 2.2.20 Fixed in 2.2.20 Patch available GHSA-rjhx-c9qh-qh8f
  • org.glassfish:jakarta.faces (Maven) Vendor— Affected before 2.3.10 Fixed in 2.3.10 Patch available GHSA-rjhx-c9qh-qh8f

CPE configurations NVD · 37

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:mojarra:*:*:*:*:*:*:*:*2.3.0 to before 2.3.10VulnerableEclipse Foundation
cpe:2.3:a:oracle:mojarra_javaserver_faces:*:*:*:*:*:*:*:*2.2.0 to before 2.2.20VulnerableOracle
cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*13.2.0.1VulnerableOracle
cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*13.3.0.1VulnerableOracle
cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableOracle
cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.8.0:*:*:*:*:*:*:*2.8.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0.0 – 8.4.0.5VulnerableOracle
cpe:2.3:a:oracle:communications_network_integrity:7.3.5:*:*:*:*:*:*:*7.3.5VulnerableOracle
cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:*7.3.6VulnerableOracle
cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableOracle
  • cpe:2.3:a:eclipse:mojarra:*:*:*:*:*:*:*:* Versions 2.3.0 to before 2.3.10 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:oracle:mojarra_javaserver_faces:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.2.20 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:* Versions 13.2.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:* Versions 13.3.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_enterprise_product_manufacturing:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.4.0.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_network_integrity:7.3.5:*:*:*:*:*:*:* Versions 7.3.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:* Versions 7.3.6 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Oracle
Show 27 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*7.4.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:*3.0VulnerableOracle
cpe:2.3:a:oracle:healthcare_data_repository:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:*15.1.0.0 – 15.2.18.7; 16.1.0.0 – 16.2.19.0; 17.1.0.0 – 17.12.15.0; 18.1.0.0 – 18.8.15.0VulnerableOracle
cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:19.12.0.0:*:*:*:*:*:*:*19.12.0.0VulnerableOracle
cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:*12.1VulnerableOracle
cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:*12.2VulnerableOracle
cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:*16.0.3.0VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_financial_integration:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_invoice_matching:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_merchandising_system:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:*15.0VulnerableOracle
cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:*16.0VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4:*:*:*:*:*:*:*14.0.4VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3:*:*:*:*:*:*:*14.1.3VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3:*:*:*:*:*:*:*15.0.3VulnerableOracle
cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3:*:*:*:*:*:*:*16.0.3VulnerableOracle
cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:*5.4VulnerableOracle
cpe:2.3:a:oracle:secure_global_desktop:5.5:*:*:*:*:*:*:*5.5VulnerableOracle
cpe:2.3:a:oracle:time_and_labor:*:*:*:*:*:*:*:*12.2.6 – 12.2.11VulnerableOracle
  • cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:* Versions 7.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_data_quality:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:health_sciences_information_manager:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:healthcare_data_repository:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:*:*:*:*:*:*:*:* Versions 15.1.0.0 – 15.2.18.7; 16.1.0.0 – 16.2.19.0; 17.1.0.0 – 17.12.15.0; 18.1.0.0 – 18.8.15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_p6_enterprise_project_portfolio_management:19.12.0.0:*:*:*:*:*:*:* Versions 19.12.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rapid_planning:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rapid_planning:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_advanced_inventory_planning:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_advanced_inventory_planning:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_assortment_planning:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_bulk_data_integration:16.0.3.0:*:*:*:*:*:*:* Versions 16.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_financial_integration:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_integration_bus:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_invoice_matching:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_merchandising_system:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_service_backbone:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:14.0.4:*:*:*:*:*:*:* Versions 14.0.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:14.1.3:*:*:*:*:*:*:* Versions 14.1.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:15.0.3:*:*:*:*:*:*:* Versions 15.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_store_inventory_management:16.0.3:*:*:*:*:*:*:* Versions 16.0.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:secure_global_desktop:5.4:*:*:*:*:*:*:* Versions 5.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:secure_global_desktop:5.5:*:*:*:*:*:*:* Versions 5.5 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:time_and_labor:*:*:*:*:*:*:*:* Versions 12.2.6 – 12.2.11 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-rjhx-c9qh-qh8f org.glassfish:javax.faces (Maven) Fixed in 2.2.20 Advisory →
  • Fix · GHSA-rjhx-c9qh-qh8f org.glassfish:jakarta.faces (Maven) Fixed in 2.3.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-17091
  2. 2026-10-03 Alias added: GHSA-rjhx-c9qh-qh8f

References

Exploit 2

Patch 13

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences