CVE-2019-17091: Eclipse Mojarra

Medium severity, CVSS 6.1. EPSS: 2.5% chance of exploitation in the next 30 days.

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

Affected products

  • Eclipse Mojarra: from 2.3.0, before 2.3.10 (fixed in 2.3.10)
  • Oracle Application Testing Suite: version 13.2.0.1 only; version 13.3.0.1 only
  • Oracle Banking Enterprise Product Manufacturing: version 2.7.0 only; version 2.8.0 only
  • Oracle Communications Diameter Signaling Router: from 8.0.0.0, up to and including 8.4.0.5
  • Oracle Communications Network Integrity: version 7.3.5 only; version 7.3.6 only
  • Oracle Communications Unified Inventory Management: version 7.3.0 only; version 7.4.0 only
  • Oracle Enterprise Data Quality: version 12.2.1.3.0 only
  • Oracle Health Sciences Information Manager: version 3.0 only
  • Oracle Healthcare Data Repository: version 7.0 only
  • Oracle Mojarra Javaserver Faces: from 2.2.0, before 2.2.20 (fixed in 2.2.20)
  • Oracle Primavera p6 Enterprise Project Portfolio Management: from 15.1.0.0, up to and including 15.2.18.7; from 16.1.0.0, up to and including 16.2.19.0; from 17.1.0.0, up to and including 17.12.15.0; from 18.1.0.0, up to and including 18.8.15.0; version 19.12.0.0 only
  • Oracle Rapid Planning: version 12.1 only; version 12.2 only
  • Oracle Retail Advanced Inventory Planning: version 15.0 only; version 16.0 only
  • Oracle Retail Assortment Planning: version 16.0.3 only
  • Oracle Retail Bulk Data Integration: version 16.0.3.0 only
  • Oracle Retail Financial Integration: version 15.0 only; version 16.0 only
  • Oracle Retail Integration Bus: version 15.0 only; version 16.0 only
  • Oracle Retail Invoice Matching: version 16.0 only
  • Oracle Retail Merchandising System: version 16.0 only
  • Oracle Retail Service Backbone: version 15.0 only; version 16.0 only
  • Oracle Retail Store Inventory Management: version 14.0.4 only; version 14.1.3 only; version 15.0.3 only; version 16.0.3 only
  • Oracle Secure Global Desktop: version 5.4 only; version 5.5 only
  • Oracle Time And Labor: from 12.2.6, up to and including 12.2.11

Published 2019-10-02. Last modified 2026-06-17.