PT-2018-2868 · Oracle · Oracle Secure Global Desktop

Rafael Pedrero · Publicado 2018-11-22 · Atualizado 2019-01-07 · CVE-2018-19439

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Secure Global Desktop versions prior to 5.4

Description The issue exists due to inadequate protection of the web page structure in the administration console. This can allow a remote attacker to execute arbitrary code in the user's browser or gain access to confidential information. The Administration Console in Oracle Secure Global Desktop is affected, with a specific example of reflected XSS via all parameters in the helpwindow.jsp page, such as the windowTitle parameter in the /sgdadmin/faces/com sun web ui/help/helpwindow.jsp endpoint.

Recommendations For Oracle Secure Global Desktop versions prior to 5.4, update to version 5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the helpwindow.jsp page to minimize the risk of exploitation. Avoid using the vulnerable parameters, such as windowTitle, in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-02399

CVE-2018-19439

Produtos afetados

Oracle Secure Global Desktop

Referências · 7

• 🔥 http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Nov/58 · Exploit
• https://osv.dev/vulnerability/CVE-2018-19439 · Aviso do Fabricante
• https://exploit.kitploit.com/2018/11/oracle-secure-global-desktop.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-19439 · Nota de Segurança
• http://securityfocus.com/bid/106006 · Nota
• https://bdu.fstec.ru/vul/2019-02399 · Nota de Segurança