CVE-2019-17091
| Affected software | 12 products, listed below |
|---|---|
| Severity | 6.1 Medium CVSS 3.1 2 scores |
| Fixed in | 2.2.20 |
| Weakness | Cross-site scripting (CWE-79) |
| Published | 2 Oct 2019 |
| Updated | 13 Nov 2026 |
Description
faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 7 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 2.5% chance in 30 days
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full XSS
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR XSS rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: XSS rule
- xss:html:|URI[;source=][;safeinjectionenabled=true|false]:allow|deny: xss:html::deny:warn
How to mitigate CVE-2019-17091
Upgrade the affected software to 2.2.20 or later. Until you can, Waratek RASP blocks exploitation with its XSS rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
6.1 MEDIUM
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2 metrics
CVSS
6.1 MEDIUM v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 6.1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
NVD | Primary | published |
| CVSS 2.0 | 4.3 | none | AV:N/AC:M/Au:N/C:N/I:P/A:N |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update April 2023 ↗ | CPU | 2023-Q2 | Oracle Fusion Middleware / ADF Faces (Eclipse Mojarra) (12.2.1.4.0) |
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle Fusion Middleware / General (Eclipse Mojarra) (12.2.1.3.0) Oracle Retail Applications / BDI Job Scheduler (Eclipse Mojarra) (16.0.3) Oracle Retail Applications / SIM Integration (Eclipse Mojarra) (14.0.4.0, 14.1.3.0, 15.0.3.0, 16.0.3.0) |
| Oracle Critical Patch Update October 2020 ↗ | CPU | 2020-Q4 | Oracle Communications / Platform (Eclipse Mojarra) (8.0.0.0-8.4.0.5) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle Communications Applications / Core (Eclipse Mojarra) (7.3.5, 7.3.6) Oracle Enterprise Manager / Load Testing for Web Apps (Eclipse Mojarra) (13.2.0.1, 13.3.0.1) Oracle Retail Applications / PeopleSoft Integration (Eclipse Mojarra) (15.0, 16.0) Oracle Retail Applications / Pricing (Eclipse Mojarra) (16.0) Oracle Retail Applications / RIB Kernal (Eclipse Mojarra) (15.0, 16.0) Oracle Retail Applications / RSB kernel (Eclipse Mojarra) (15.0, 16.0) Oracle Supply Chain / Installation (Eclipse Mojarra) (12.1, 12.2) |
| Oracle Critical Patch Update April 2020 ↗ | CPU | 2020-Q2 | Oracle Financial Services Applications / Core (Eclipse Mojarra) (2.7.0, 2.8.0) Oracle Health Sciences Applications / Installation (Eclipse Mojarra) (7.0) Oracle Health Sciences Applications / Policy Engine (Eclipse Mojarra) (3.0) Oracle Retail Applications / AIP Dashboard (Eclipse Mojarra) (15.0, 16.0) Oracle Retail Applications / Inventory Tracking (Eclipse Mojarra) (16.0) |
| Oracle Critical Patch Update January 2020 ↗ | CPU | 2020-Q1 | Oracle Communications Applications / Maps (Mojarra) (7.3, 7.4) Oracle Construction and Engineering / Web Access (Mojarra) (15.1.0.0-15.2.18.7, 16.1.0.0-16.2.19.0, 17.1.0.0-17.12.15.0, 18.1.0.0-18.8.15.0, 19.12.0.0) Oracle Retail Applications / Application Core (Mojarra) (16.0.3) Oracle Virtualization / Core (Mojarra) (5.4, 5.5) |
| Oracle Critical Patch Update October 2019 ↗ | CPU | 2019-Q4 | Oracle Fusion Middleware / Web Container (JavaServer Faces) (12.2.1.3.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications | Platform (Eclipse Mojarra) | 8.0.0.0-8.4.0.5 | |
| Oracle Communications Applications | Core (Eclipse Mojarra) | 7.3.5, 7.3.6 | 7.3.5 · 7.3.6 |
| Oracle Communications Applications | Maps (Mojarra) | 7.3, 7.4 | 7.3 · 7.4 |
| Oracle Construction and Engineering | Web Access (Mojarra) | 15.1.0.0-15.2.18.7, 16.1.0.0-16.2.19.0, 17.1.0.0-17.12.15.0, 18.1.0.0-18.8.15.0, 19.12.0.0 | 19.12.0.0 |
| Oracle Enterprise Manager | Load Testing for Web Apps (Eclipse Mojarra) | 13.2.0.1, 13.3.0.1 | 13.2.0.1 · 13.3.0.1 |
| Oracle Financial Services Applications | Core (Eclipse Mojarra) | 2.7.0, 2.8.0 | 2.7.0 · 2.8.0 |
| Oracle Fusion Middleware | ADF Faces (Eclipse Mojarra) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle Fusion Middleware | General (Eclipse Mojarra) | 12.2.1.3.0 | 12.2.1.3.0 |
| Oracle Fusion Middleware | Web Container (JavaServer Faces) | 12.2.1.3.0 | 12.2.1.3.0 |
| Oracle Health Sciences Applications | Installation (Eclipse Mojarra) | 7.0 | 7.0 |
| Oracle Health Sciences Applications | Policy Engine (Eclipse Mojarra) | 3.0 | 3.0 |
| Oracle Retail Applications | AIP Dashboard (Eclipse Mojarra) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | Application Core (Mojarra) | 16.0.3 | 16.0.3 |
| Oracle Retail Applications | BDI Job Scheduler (Eclipse Mojarra) | 16.0.3 | 16.0.3 |
| Oracle Retail Applications | Inventory Tracking (Eclipse Mojarra) | 16.0 | 16.0 |
| Oracle Retail Applications | PeopleSoft Integration (Eclipse Mojarra) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | Pricing (Eclipse Mojarra) | 16.0 | 16.0 |
| Oracle Retail Applications | RIB Kernal (Eclipse Mojarra) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | RSB kernel (Eclipse Mojarra) | 15.0, 16.0 | 15.0 · 16.0 |
| Oracle Retail Applications | SIM Integration (Eclipse Mojarra) | 14.0.4.0, 14.1.3.0, 15.0.3.0, 16.0.3.0 | 14.0.4.0 · 14.1.3.0 · 15.0.3.0 · 16.0.3.0 |
| Oracle Supply Chain | Installation (Eclipse Mojarra) | 12.1, 12.2 | 12.1 · 12.2 |
| Oracle Virtualization | Core (Mojarra) | 5.4, 5.5 | 5.4 · 5.5 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.glassfish:javax.faces |
0 | 2.2.20 |
unbounded |
org.glassfish:jakarta.faces |
0 | 2.3.10 |
unbounded |
Products and versions
25 products, 42 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | eclipse | mojarra | generic | ≥ 2.3.0 and ＜ 2.3.10 |
| nvd | oracle | application testing suite | generic | 13.2.0.1 · 13.3.0.1 |
| nvd | oracle | banking enterprise product manufacturing | generic | 2.7.0 · 2.8.0 |
| nvd | oracle | communications diameter signaling router | generic | ≥ 8.0.0.0 and ≤ 8.4.0.5 |
| nvd | oracle | communications network integrity | generic | 7.3.5 · 7.3.6 |
| nvd | oracle | communications unified inventory management | generic | 7.3.0 · 7.4.0 |
| nvd | oracle | enterprise data quality | generic | 12.2.1.3.0 |
| nvd | oracle | health sciences information manager | generic | 3.0 |
| nvd | oracle | healthcare data repository | generic | 7.0 |
| nvd | oracle | mojarra javaserver faces | generic | ≥ 2.2.0 and ＜ 2.2.20 |
| nvd | oracle | primavera p6 enterprise project portfolio management | generic | ≥ 15.1.0.0 and ≤ 15.2.18.7 · ≥ 16.1.0.0 and ≤ 16.2.19.0 · ≥ 17.1.0.0 and ≤ 17.12.15.0 · ≥ 18.1.0.0 and ≤ 18.8.15.0 · 19.12.0.0 |
| nvd | oracle | rapid planning | generic | 12.1 · 12.2 |
| nvd | oracle | retail advanced inventory planning | generic | 15.0 · 16.0 |
| nvd | oracle | retail assortment planning | generic | 16.0.3 |
| nvd | oracle | retail bulk data integration | generic | 16.0.3.0 |
| nvd | oracle | retail financial integration | generic | 15.0 · 16.0 |
| nvd | oracle | retail integration bus | generic | 15.0 · 16.0 |
| nvd | oracle | retail invoice matching | generic | 16.0 |
| nvd | oracle | retail merchandising system | generic | 16.0 |
| nvd | oracle | retail service backbone | generic | 15.0 · 16.0 |
| nvd | oracle | retail store inventory management | generic | 14.0.4 · 14.1.3 · 15.0.3 · 16.0.3 |
| nvd | oracle | secure global desktop | generic | 5.4 · 5.5 |
| nvd | oracle | time and labor | generic | ≥ 12.2.6 and ≤ 12.2.11 |
| osv | org.glassfish | jakarta.faces | generic | ＜ 2.3.10 |
| osv | org.glassfish | javax.faces | generic | ＜ 2.2.20 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, INSTALLATION (ECLIPSE MOJARRA), RSB KERNEL (ECLIPSE MOJARRA), INVENTORY TRACKING (ECLIPSE MOJARRA), PEOPLESOFT INTEGRATION (ECLIPSE MOJARRA), AIP DASHBOARD (ECLIPSE MOJARRA), MULTIPLE, NO AUTH REMOTE EXPLOIT, SIM INTEGRATION (ECLIPSE MOJARRA), GENERAL (ECLIPSE MOJARRA), CORE (MOJARRA), RIB KERNAL (ECLIPSE MOJARRA), CORE (ECLIPSE MOJARRA), WEB ACCESS (MOJARRA), PRICING (ECLIPSE MOJARRA), PLATFORM (ECLIPSE MOJARRA), WEB CONTAINER (JAVASERVER FACES), POLICY ENGINE (ECLIPSE MOJARRA), MAPS (MOJARRA), BDI JOB SCHEDULER (ECLIPSE MOJARRA), LOAD TESTING FOR WEB APPS (ECLIPSE MOJARRA), APPLICATION CORE (MOJARRA) **Products:** ORACLE ENTERPRISE MANAGER, ORACLE RAPID PLANNING, ORACLE HEALTHCARE DATA REPOSITORY, ORACLE RETAIL ASSORTMENT PLANNING, ORACLE BANKING ENTERPRISE PRODUCT MANUFACTURING, ORACLE RETAIL FINANCIAL INTEGRATION, ORACLE FINANCIAL SERVICES APPLICATIONS, ORACLE RETAIL MERCHANDISING SYSTEM, ORACLE RETAIL BULK DATA INTEGRATION, ORACLE RETAIL APPLICATIONS, ORACLE SECURE GLOBAL DESKTOP, ORACLE APPLICATION TESTING SUITE, ORACLE RETAIL STORE INVENTORY MANAGEMENT, ORACLE SUPPLY CHAIN, ORACLE CONSTRUCTION AND ENGINEERING, ORACLE WEBLOGIC SERVER, PRIMAVERA P6 ENTERPRISE PROJECT PORTFOLIO MANAGEMENT, ORACLE VIRTUALIZATION, ORACLE COMMUNICATIONS DIAMETER SIGNALING ROUTER (DSR), ORACLE HEALTH SCIENCES INFORMATION MANAGER, ORACLE FUSION MIDDLEWARE, ORACLE COMMUNICATIONS NETWORK INTEGRITY, ORACLE RETAIL INTEGRATION BUS, ORACLE COMMUNICATIONS, ORACLE RETAIL SERVICE BACKBONE, ORACLE COMMUNICATIONS UNIFIED INVENTORY MANAGEMENT, ORACLE RETAIL ADVANCED INVENTORY PLANNING, ORACLE ENTERPRISE DATA QUALITY, ORACLE RETAIL INVOICE MATCHING, ORACLE COMMUNICATIONS APPLICATIONS, ORACLE HEALTH SCIENCES APPLICATIONS
References
Timeline
Timeline
| Published | 2019-10-02 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |