CVE-2019-3872

It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks.

Score

CVSS 3.0 5.4 Medium

Status

Modified - secalert@redhat.com

Published

2019-06-12

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Picketlink (Red Hat)
• Jboss Enterprise Application Platform (Redhat)
• Single Sign-on (Redhat)

References

• http://www.securityfocus.com/bid/108732
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3872