MEDIUM🇵🇱 Wersja polska

CVE-2017-12158

CVSS 5.4v3.0pub. 2017-10-26upd. 2026-05-13

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

  • Keycloak

    APP
    Keycloak
    all versions

  • Red Hat Enterprise Linux Server

    OS
    Redhat
    6.07.0

  • Red Hat Single Sign On

    APP
    Redhat
    7.07.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2021-40438CRITICAL9.0⚠ KEVPL ✓same product

SSRF w mod_proxy Apache HTTP Server — przekierowanie żądań przez atakującego

CVE-2019-5544CRITICAL9.8⚠ KEVPL ✓same product

Krytyczny heap overwrite w OpenSLP dla VMware ESXi i Horizon DaaS

CVE-2016-4171CRITICAL9.8⚠ KEVPL ✓same product

RCE w Adobe Flash Player 21.0.0.242 i wcześniejszych — aktywnie exploitowany

CVE-2016-4117CRITICAL9.8⚠ KEVPL ✓same product

Adobe Flash Player — RCE umożliwiający wykonanie dowolnego kodu

CVE-2016-3427CRITICAL9.8⚠ KEVPL ✓same product

Krytyczna podatność RCE w Oracle Java SE i JRockit — komponent JMX