PT-2018-2868 · Oracle · Oracle Secure Global Desktop

Rafael Pedrero · Published 2018-11-22 · Updated 2019-01-07 · CVE-2018-19439

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Oracle Secure Global Desktop versions prior to 5.4

Description The issue exists due to inadequate protection of the web page structure in the administration console. This can allow a remote attacker to execute arbitrary code in the user's browser or gain access to confidential information. The Administration Console in Oracle Secure Global Desktop is affected, with a specific example of reflected XSS via all parameters in the helpwindow.jsp page, such as the windowTitle parameter in the /sgdadmin/faces/com sun web ui/help/helpwindow.jsp endpoint.

Recommendations For Oracle Secure Global Desktop versions prior to 5.4, update to version 5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the helpwindow.jsp page to minimize the risk of exploitation. Avoid using the vulnerable parameters, such as windowTitle, in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-02399

CVE-2018-19439

Affected Products

Oracle Secure Global Desktop

References · 7

• 🔥 http://packetstormsecurity.com/files/150444/Oracle-Secure-Global-Desktop-Administration-Console-4.4-Cross-Site-Scripting.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Nov/58 · Exploit
• https://osv.dev/vulnerability/CVE-2018-19439 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19439 · Security Note
• https://bdu.fstec.ru/vul/2019-02399 · Security Note
• https://exploit.kitploit.com/2018/11/oracle-secure-global-desktop.html · Note
• http://securityfocus.com/bid/106006 · Note