CVE-2019-3872: Red Hat JBoss Enterprise Application Platform

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks.

Affected products

• Red Hat JBoss Enterprise Application Platform: version 7.2.0 only
• Red Hat Single Sign-On: version 7.0 only

Published 2019-06-12. Last modified 2026-06-17.