CVE-2018-19439

EPSS 20.5%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 20.5%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

13 Dec 2018Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.

Affected products

n/a · n/a

References

http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2018/Nov/58 http://www.securityfocus.com/bid/106006