GitHub Advisoryadvisory · Maven

GHSA-v38p-mqq3-m6v5 Keycloak Reflected XSS

MEDIUM Published 2022-05-13 Modified 2023-07-26 Official page ↗
Aliases
CVE-2017-12158
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2023-07-26

Affected packages

• Maven org.keycloak:keycloak-parent: < 3.4.0 → fixed in 3.4.0

Description

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

Related

Alias · CVE (1)

  • CVE-2017-12158 It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References