Medium severity5.4NVD Advisory· Published Oct 26, 2017· Updated May 13, 2026
CVE-2017-12158
CVE-2017-12158
Description
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-parentMaven | < 3.4.0 | 3.4.0 |
Affected products
4- Red Hat, Inc./keycloakv5Range: 3.4.0
cpe:2.3:a:redhat:single_sign_on:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:redhat:single_sign_on:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:single_sign_on:7.1:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
8- www.securityfocus.com/bid/101618nvdThird Party AdvisoryVDB Entry
- access.redhat.com/errata/RHSA-2017:2904nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2905nvdThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2906nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-v38p-mqq3-m6v5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-12158ghsaADVISORY
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingWEB
- web.archive.org/web/20210124114020/http://www.securityfocus.com/bid/101618ghsaWEB
News mentions
0No linked articles in our index yet.