CVE-2019-17091

6.1 mediumEPSS 2.5%

Medium (6.1). EPSS 2.5% chance of exploitation in the next 30 days. Fixed in org.glassfish:javax.faces 2.2.20.

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 2.5% chance of exploitation in the next 30 days; higher than 84% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2019-10-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

eclipse:mojarra
oracle:application_testing_suite
oracle:banking_enterprise_product_manufacturing
oracle:communications_diameter_signaling_router
oracle:communications_network_integrity
oracle:communications_unified_inventory_management
oracle:enterprise_data_quality
oracle:health_sciences_information_manager
oracle:healthcare_data_repository
oracle:mojarra_javaserver_faces
oracle:primavera_p6_enterprise_project_portfolio_management
oracle:rapid_planning
oracle:retail_advanced_inventory_planning
oracle:retail_assortment_planning
oracle:retail_bulk_data_integration
oracle:retail_financial_integration
oracle:retail_integration_bus
oracle:retail_invoice_matching
oracle:retail_merchandising_system
oracle:retail_service_backbone
oracle:retail_store_inventory_management
oracle:secure_global_desktop
oracle:time_and_labor

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-rjhx-c9qh-qh8f	Maven	org.glassfish:javax.faces	<2.2.20	2.2.20
GHSA-rjhx-c9qh-qh8f	Maven	org.glassfish:jakarta.faces	<2.3.10	2.3.10

References

Check your stack JSON