PT-2019-5651 · Red Hat · Red Hat Jboss Enterprise Application Platform
Chess Hazlett
·
Publicado
2019-06-10
·
Atualizado
2019-07-06
·
CVE-2019-3873
CVSS v3.1
9.0
Crítica
| Vetor | AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
JBoss Enterprise Application Platform version 7.2
Description
The issue exists due to inadequate protection of the web page structure in the Picketlink component. This could allow a remote attacker to perform cross-site scripting attacks. An attacker could exploit this by sending a URL with an
xinclude parameter in the SAML response XML to achieve cross-site scripting or conduct further attacks.Recommendations
For JBoss Enterprise Application Platform version 7.2, consider restricting access to the
xinclude parameter in SAML response XML to minimize the risk of exploitation. As a temporary workaround, avoid using the xinclude parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat Jboss Enterprise Application Platform