CVE-2018-16955

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources
Severity
6.1MEDIUM
EPSS
0.2%
top 60.52%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Oracle Webcenter Interaction
Timeline
PublishedSep 18
Latest updateMay 14

Description

The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). The content of the in_hi_redirect parameter, when prefixed with the https:// scheme, is unsafely reflected in a HTML META tag in the HTTP response. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-4gx9-fv89-q93q: The login function of Oracle WebCenter Interaction Portal 10↗2022-05-14
▶
CVEList
CVE-2018-16955: The login function of Oracle WebCenter Interaction Portal 10↗2018-09-18
▶