Medium severity · published Dec 13, 2018
CVE-2018-19439
XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4)
6.1
CVSS
20.5%
EPSS
No
On KEV
Description
XSS exists in the Administration Console in Oracle Secure Global Desktop 4.4 20080807152602 (but was fixed in later versions including 5.4). helpwindow.jsp has reflected XSS via all parameters, as demonstrated by the sgdadmin/faces/com_sun_web_ui/help/helpwindow.jsp windowTitle parameter.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)20.5% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
Secure Global Desktop · Oracle
4.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-19439
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-19439
Exploit
http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html
Exploit
http://seclists.org/fulldisclosure/2018/Nov/58
Third Party Advisory
http://www.securityfocus.com/bid/106006
More from Secure Global Desktop
9.0
CVE-2021-40438
mod_proxy SSRF
10.0
CVE-2021-2248
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server)
10.0
CVE-2021-2177
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Gateway)
9.9
CVE-2021-2447
Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server)
9.8
CVE-2019-3822
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow