Description
It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks.
Remediation
References
Related Vulnerabilities
Moodle Improper Privilege Management Vulnerability (CVE-2023-5549)
Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-3514)
WordPress Plugin WP iCommerce-the first interactive ecommerce for wordpress SQL Injection (1.1.1)
Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2021-43941)
WordPress Plugin File Manager Multiple Cross-Site Request Forgery Vulnerabilities (5.0)