CVE-2019-3873

CVE-2019-3873 describes a critical cross-site scripting (XSS) vulnerability in Picketlink, as integrated into JBoss Enterprise Application Platform 7.2, Red Hat Enterprise Linux, and Red Hat Single Sign-On. An authenticated attacker could inject an xinclude parameter into a SAMLresponse XML, leading to XSS or potentially more severe attacks. This vulnerability carries a CVSS v3 score of 9.0 (CRITICAL) due to its network-based attack vector, low complexity, and high impact on confidentiality, integrity, and availability, requiring user interaction. While there is no evidence of active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.