CVE-2018-16953

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.2%
top 60.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Oracle Webcenter Interaction
Timeline
PublishedSep 18
Latest updateMay 14

Description

The AjaxView::DisplayResponse() function of the portalpages.dll assembly in Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). User input from the name parameter is unsafely reflected in the server response. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-8vhv-jr5w-885q: The AjaxView::DisplayResponse() function of the portalpages↗2022-05-14
▶
CVEList
CVE-2018-16953: The AjaxView::DisplayResponse() function of the portalpages↗2018-09-18
▶