PT-2019-3784 · Oracle+1 · Mojarra Javaserver Faces+2

Publicado 2019-06-13 · Atualizado 2022-05-24 · CVE-2019-17091

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Mojarra versions prior to 2.3.10 Mojarra JavaServer Faces versions prior to 2.2.20

Description The issue is related to the mishandling of a client window field in the faces/context/PartialViewContextImpl.java component of Eclipse Mojarra, which can lead to Reflected XSS attacks. This allows a remote attacker to perform a cross-site scripting attack.

Recommendations For Eclipse Mojarra versions prior to 2.3.10, update to version 2.3.10 or later. For Mojarra JavaServer Faces versions prior to 2.2.20, update to version 2.2.20 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-04080

CVE-2019-17091

GHSA-RJHX-C9QH-QH8F

Produtos afetados

Eclipse Mojarra

Mojarra Javaserver Faces

Oracle Weblogic Server

Referências · 22

• 🔥 https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt · Exploit
• 🔥 https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244 · Exploit
• https://github.com/eclipse-ee4j/mojarra/compare/2.3.9-RELEASE...2.3.10-RELEASE · Nota
• https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee · Correção
• https://github.com/eclipse-ee4j/mojarra/issues/4556 · Nota
• https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f · Correção
• https://github.com/eclipse-ee4j/mojarra/pull/4567 · Correção
• https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe · Correção
• https://github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4 · Correção
• https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20 · Correção
• https://bdu.fstec.ru/vul/2019-04080 · Nota de Segurança
• https://oracle.com/security-alerts/cpujan2020.html · Correção
• https://osv.dev/vulnerability/CVE-2019-17091 · Aviso do Fabricante
• https://oracle.com/security-alerts/cpuoct2020.html · Correção
• https://oracle.com/security-alerts/cpuapr2020.html · Correção