Medium 6.1HealthcarePublished Oct 2, 2019

CVE-2019-17091faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client windo…

Updated under an hour ago (Oct 27, 2026, 2:50 AM ET)

Does this affect you?

It affects eclipse mojarra and 22 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 2.47%, higher than 84% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for eclipse mojarra

Exploited in the last 30 days

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

CVSS: 6.1 MEDIUM (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 2.47% (percentile 84)
Assigned by: mitre
NVD analysis: Modified
Record last updated: Aug 4, 2024
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

eclipse mojarra eclipse:mojarra	from 2.3.0 before 2.3.10	NVD
oracle mojarra_javaserver_faces oracle:mojarra_javaserver_faces	from 2.2.0 before 2.2.20	NVD
oracle application_testing_suite oracle:application_testing_suite	13.2.0.1; 13.3.0.1	NVD
oracle banking_enterprise_product_manufacturing oracle:banking_enterprise_product_manufacturing	2.7.0; 2.8.0	NVD
oracle communications_diameter_signaling_router oracle:communications_diameter_signaling_router	from 8.0.0.0 through 8.4.0.5	NVD
oracle communications_network_integrity oracle:communications_network_integrity	7.3.5; 7.3.6	NVD
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management	7.3.0; 7.4.0	NVD
oracle enterprise_data_quality oracle:enterprise_data_quality	12.2.1.3.0	NVD
oracle health_sciences_information_manager oracle:health_sciences_information_manager	3.0	NVD
oracle healthcare_data_repository oracle:healthcare_data_repository	7.0	NVD
1–10 of 23

References

References

https://www.oracle.com/security-alerts/cpuapr2020.html	x-refsource-misc, patch, third-party-advisory
https://www.oracle.com/security-alerts/cpujul2020.html	x-refsource-misc, patch, third-party-advisory
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	x-refsource-misc, patch, third-party-advisory
https://www.oracle.com/security-alerts/cpujan2020.html	x-refsource-misc, patch, third-party-advisory
https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244	x-refsource-misc, exploit, issue-tracking, patch, vendor-advisory
https://github.com/eclipse-ee4j/mojarra/pull/4567	x-refsource-misc, patch, third-party-advisory
https://github.com/eclipse-ee4j/mojarra/issues/4556	x-refsource-misc, third-party-advisory
https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt	x-refsource-misc, exploit, third-party-advisory
https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE	x-refsource-misc, release-notes, third-party-advisory
https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee	x-refsource-misc, patch, third-party-advisory
1–10 of 17

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.