CVE-2018-16955

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Interaction Portal version 10.3.3

Description The login function is susceptible to reflected cross-site scripting (XSS) due to the unsafe reflection of the content of the in hi redirect parameter in an HTML META tag in the HTTP response, specifically when the parameter is prefixed with the https:// scheme.

Recommendations For Oracle WebCenter Interaction Portal version 10.3.3, as a temporary workaround, consider restricting the use of the in hi redirect parameter in the login function until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.