CVE-2019-3873

Description

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks.

Risk Information

Base Score

9.0

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.403

Associated Vulnerability

Vulnerability	OS Platform
Multiple Vulnerabilities are affected in Red Hat JBoss Enterprise Application Platform 7 7.2.0	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234