Read the docs
TI-2019-02883 Aliases CVE-2019-3873GHSA-59jq-66fv-jgww

Cross-site scripting in Red Hat picketlink

Priority MEDIUM 41CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-79.

Summary

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks.

Why it matters now

EPSS 0.0091 60th percentileScored 2026-11-07
Fix Fixed Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatpicketlinkas shipped with Jboss Enterprise Application Server 7.2—No fix listedCNA
  • picketlink VendorRed Hat Affected as shipped with Jboss Enterprise Application Server 7.2 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

Red Hat 5 advisories

  • RHSA-2019:1456 Released 2019-06-11 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.3.2 security update
    • Red Hat Single Sign-On 7.3.2 zip
  • RHSA-2019:1424 Released 2019-06-10 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.2.2 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2019:1420 Released 2019-06-10 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-commons-codec-1.11.0-2.redhat_00001.1.el7eap, eap7-apache-cxf-3.2.7-2.redhat_00002.1.el7eap, eap7-apache-cxf-rt-3.2.7-2.redhat_00002.1.el7eap +47
Show 2 more Red Hat advisories
  • RHSA-2019:1421 Released 2019-06-10 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-commons-codec-1.11.0-2.redhat_00001.1.el8eap, eap7-apache-cxf-3.2.7-2.redhat_00002.1.el8eap, eap7-apache-cxf-rt-3.2.7-2.redhat_00002.1.el8eap +47
  • RHSA-2019:1419 Released 2019-06-10 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-commons-codec-1.11.0-2.redhat_00001.1.el6eap, eap7-apache-cxf-3.2.7-2.redhat_00002.1.el6eap, eap7-apache-cxf-rt-3.2.7-2.redhat_00002.1.el6eap +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss EAP 7.2Fixed RHSA-2019:1424
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2019:1419
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2019:1420
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2019:1421
Red Hat Single Sign-On 7.3.2 zipFixed RHSA-2019:1456

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3873
  2. 2026-10-03 Alias added: GHSA-59jq-66fv-jgww

References

Advisory 1

  • TI-2017-08941 Deserialization of untrusted data in Red Hat jbossas KEVCVSS 3.1CRITICAL 9.8
  • TI-2010-01790 JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for… KEVCVSS 3.1HIGH 8.8
  • TI-2017-09342 Unrestricted file upload in Apache Tomcat KEVCVSS 3.1HIGH 8.1
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2010-01383 The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application… KEVCVSS 3.1HIGH 7.5
  • TI-2017-09354 XML external entity injection in Apache Solr before 7.1 with Apache Lucene before 7.1 CVSS 3.1CRITICAL 9.8
See all 243 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences