PT-2019-3784 · Oracle+1 · Mojarra Javaserver Faces+2

Published 2019-06-13 · Updated 2022-05-24 · CVE-2019-17091

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Eclipse Mojarra versions prior to 2.3.10 Mojarra JavaServer Faces versions prior to 2.2.20

Description The issue is related to the mishandling of a client window field in the faces/context/PartialViewContextImpl.java component of Eclipse Mojarra, which can lead to Reflected XSS attacks. This allows a remote attacker to perform a cross-site scripting attack.

Recommendations For Eclipse Mojarra versions prior to 2.3.10, update to version 2.3.10 or later. For Mojarra JavaServer Faces versions prior to 2.2.20, update to version 2.2.20 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-04080

CVE-2019-17091

GHSA-RJHX-C9QH-QH8F

Affected Products

Eclipse Mojarra

Mojarra Javaserver Faces

Oracle Weblogic Server

References · 22

• 🔥 https://github.com/eclipse-ee4j/mojarra/files/3039198/advisory.txt · Exploit
• 🔥 https://bugs.eclipse.org/bugs/show_bug.cgi?id=548244 · Exploit
• https://github.com/eclipse-ee4j/mojarra/commit/8f70f2bd024f00ecd5b3dcca45df73edda29dcee · Patch
• https://github.com/eclipse-ee4j/mojarra/commit/a3fa9573789ed5e867c43ea38374f4dbd5a8f81f · Patch
• https://github.com/eclipse-ee4j/mojarra/pull/4567 · Patch
• https://github.com/javaserverfaces/mojarra/commit/ae1c234d0a6750822ac69d4ae26d90e3571f27fe · Patch
• https://github.com/javaserverfaces/mojarra/commit/f61935cd39f34329fbf27b1972a506fbdd0ab4d4 · Patch
• https://github.com/javaserverfaces/mojarra/compare/2.2.19...2.2.20 · Patch
• https://bdu.fstec.ru/vul/2019-04080 · Security Note
• https://oracle.com/security-alerts/cpujan2020.html · Patch
• https://osv.dev/vulnerability/CVE-2019-17091 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2020.html · Patch
• https://oracle.com/security-alerts/cpuapr2020.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-17091 · Security Note
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Patch