Vulnetix
Try Vulnetix Request Demo
CVE-2017-12158 PUBLISHED CVSS 3.5 LOW

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

EPSS 0.67% · 71.1th percentile

Risk Scores

CVSS v2.0
3.5
EPSS Score
0.67%
71.1th percentile

Affected Products

VendorProductVersions
Red Hat, Inc.keycloak3.4.0
redhatsingle_sign_on7.0, 7.1
keycloakkeycloak
Mavenorg.keycloak:keycloak-parent0

Timeline

References

Open in Interactive Console →