CVE-2017-12158CWE-444

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations

published October 26, 2017

CVSS
—
EPSS
1%
Percentile
63.1
In the wild
Unconfirmed
What it is

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01021 · 63.1th percentile
Weakness
CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Published
2017-10-26T17:00Z
EPSS history
Timeline
  • 26 OCT 17:00Z
    It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations
    cvelistv5