Skip to content
fr Sign in
6.4 Medium

CVE-2019-3873 It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude…

Description

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks.

Affected products and versions

Product Affected versions Fixed in
picketlink Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of picketlink

The 2 CVEs of picketlink →
CVE-2019-3872 It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss… 5.4 Medium
Track this CVE