CVE-2018-19439
medium · 6.1A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.
6.1
CVSS
20.5%
EPSS (exploit prob.)
97th
EPSS percentile
2018-12-13
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| oracle | secure_global_desktop | 4.4 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2018/Nov/58
- http://www.securityfocus.com/bid/106006
- http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html
- http://seclists.org/fulldisclosure/2018/Nov/58
- http://www.securityfocus.com/bid/106006
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2018-19439