id: CVE-2018-19439 info: name: Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting author: madrobot,dwisiswant0 severity: medium description: Oracle Secure Global Desktop Administration Console 4.4 contains a reflected cross-site scripting vulnerability in helpwindow.jsp via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the victim's browser, potentially leading to session hijacking or unauthorized actions. remediation: Fixed in later versions including 5.4. reference: - http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html - https://nvd.nist.gov/vuln/detail/CVE-2018-19439 - http://seclists.org/fulldisclosure/2018/Nov/58 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-19439 cwe-id: CWE-79 epss-score: 0.01097 epss-percentile: 0.82731 cpe: cpe:2.3:a:oracle:secure_global_desktop:4.4:*:*:*:*:*:*:* metadata: max-request: 1 vendor: oracle product: secure_global_desktop tags: oracle,xss,seclists,packetstorm,cve,cve2018 http: - method: GET path: - "{{BaseURL}}/sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp?=&windowTitle=AdministratorHelpWindow>