CVE-2018-19439

MEDIUMNuclei

Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2018-19439 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMOracle Secure Global Desktop Administration Console 4.4 - Cross-Site ScriptingCVSS 6.1

Oracle Secure Global Desktop Administration Console 4.4 contains a reflected cross-site scripting vulnerability in helpwindow.jsp via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking or unauthorized actions.

Remediation

Fixed in later versions including 5.4.

WeaknessesCWE-79
Authorsmadrobot, dwisiswant0
Template tagscvecve2018oraclexssseclistspacketstormvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:oracle:secure_global_desktop:4.4:*:*:*:*:*:*:*
http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html https://nvd.nist.gov/vuln/detail/CVE-2018-19439 http://seclists.org/fulldisclosure/2018/Nov/58 https://github.com/sobinge/nuclei-templates https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

4