CVE-2018-16955 The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). The content of the in_hi_redirect parameter, when prefixed with the https:// sch...
MediumCVSS 6.1
EPSS 0.82%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The login function of Oracle WebCenter Interaction Portal 10.3.3 is vulnerable to reflected cross-site scripting (XSS). The content of the in_hi_redirect parameter, when prefixed with the https:// scheme, is unsafely reflected in a HTML META tag in the HTTP response. NOTE: this CVE is assigned by MITRE and isn't validated by Oracle because Oracle WebCenter Interaction Portal is out of support.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| oracle webcenter interaction | = 10.3.3 | No fix listed |
References
- 105350 third-party-advisory vdb-entry
- seclists.org mailing-list third-party-advisory