ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2019-3873

—
CVSS 3.0
9.0 critical
EPSS
<1%p58
Published
()
Modified
Description

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks.

Vendors
redhat
Products
jboss enterprise application platform, single sign-on
Weakness
CWE-79
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (0.9%)

In the news

No ingested article mentions this CVE yet.