Vulnerability Details CVE-2018-19439
XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.628
EPSS Ranking 98.2%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
- http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2018/Nov/58
- http://www.securityfocus.com/bid/106006
- http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2018/Nov/58
- http://www.securityfocus.com/bid/106006
Products affected by CVE-2018-19439
-
cpe:2.3:a:oracle:secure_global_desktop:4.4