CVE-2018-19439

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

20.46%

Published

Dec 13, 2018

Modified

Nov 21, 2024

Public PoC / Exploit (2)

All weaponized →

NucleiNuclei detection template TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.

Weaknesses (CWE)

CWE-79

Affected Products (1)

oracle · secure_global_desktopvulnerable

References (6)

http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2018/Nov/58

ExploitMailing ListThird Party Advisory

http://www.securityfocus.com/bid/106006

Third Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html