id: CVE-2018-19439 info: name: Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting author: madrobot,dwisiswant0 severity: medium description: Oracle Secure Global Desktop Administration Console 4.4 contains a reflected cross-site scripting vulnerability in helpwindow.jsp via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter. reference: - http://web.archive.org/web/20210124221313/https://www.securityfocus.com/bid/106006/ - http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html - https://nvd.nist.gov/vuln/detail/CVE-2018-19439 - http://seclists.org/fulldisclosure/2018/Nov/58 remediation: Fixed in later versions including 5.4. classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-19439 cwe-id: CWE-79 tags: oracle,xss,seclists,packetstorm,cve,cve2018 metadata: max-request: 1 http: - method: GET path: - "{{BaseURL}}/sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp?=&windowTitle=AdministratorHelpWindow>