CVE-2019-17091

Fixed upstream EPSS 2%

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

Published 2019-10-02 · CVE record · OSV

Products: eclipse mojarra, oracle mojarra_javaserver_faces, oracle application_testing_suite, oracle banking_enterprise_product_manufacturing, oracle communications_diameter_signaling_router, oracle communications_network_integrity, oracle communications_unified_inventory_management, oracle enterprise_data_quality, oracle health_sciences_information_manager, oracle healthcare_data_repository, oracle primavera_p6_enterprise_project_portfolio_management, oracle rapid_planning, oracle retail_advanced_inventory_planning, oracle retail_assortment_planning, oracle retail_bulk_data_integration, oracle retail_financial_integration, oracle retail_integration_bus, oracle retail_invoice_matching, oracle retail_merchandising_system, oracle retail_service_backbone, oracle retail_store_inventory_management, oracle secure_global_desktop, oracle time_and_labor

Fixed upstream