CVE-2018-19439

EPSS 20.5%

Vexday Risk Score

23Baixo

Decisão SSVC (CISA)

Attend

PoC disponível → acompanhar de perto

Maturidade do exploit

Exploit funcional

Exploit automatizável disponível (Nuclei/Metasploit).

CVSS —EPSS 20.5%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

13 dez 2018Publicada no NVD

Recomendação: Planejar correção próxima — já existe PoC pública.

XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.

Produtos afetados

n/a · n/a

Referências

http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2018/Nov/58 http://www.securityfocus.com/bid/106006