Lucene search
GitHub Advisory DatabaseGHSA-V38P-MQQ3-M6V5HistoryMay 13, 2022 - 1:38 a.m.
Keycloak Reflected XSS
2022-05-1301:38:14
CWE-79
GitHub Advisory Database
github.com
12
0.002 Low
EPSS
Percentile
54.3%
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.keycloak:keycloak-parent | lt | 3.4.0 |
References
access.redhat.com/errata/RHSA-2017:2904
access.redhat.com/errata/RHSA-2017:2905
access.redhat.com/errata/RHSA-2017:2906
bugzilla.redhat.com/show_bug.cgi?id=1489161
github.com/advisories/GHSA-v38p-mqq3-m6v5
nvd.nist.gov/vuln/detail/CVE-2017-12158
web.archive.org/web/20210124114020/www.securityfocus.com/bid/101618
Related
prion
prion
Design/Logic Flaw
2017-10-26 17:29:00
redhatcve
redhatcve
CVE-2017-12158
2017-10-17 19:49:22
veracode
veracode
Reflected Cross-site Scripting (XSS)
2017-10-27 01:24:27
osv
osv
Keycloak Reflected XSS
2022-05-13 01:38:14
cve
cve
CVE-2017-12158
2017-10-26 17:29:00
cvelist
cvelist
CVE-2017-12158
2017-10-17 00:00:00
nessus
nessus
RHEL 6 : rh-sso7-keycloak (RHSA-2017:2904)
2017-10-19 00:00:00
RHEL 7 : rh-sso7-keycloak (RHSA-2017:2905)
2017-10-19 00:00:00
redhat
redhat
(RHSA-2017:2904) Moderate: rh-sso7-keycloak security update
2017-10-17 19:40:36
(RHSA-2017:2905) Moderate: rh-sso7-keycloak security update
2017-10-17 19:40:56
(RHSA-2017:2906) Moderate: Red Hat Single Sign-On security update
2017-10-17 19:41:35