~ / search / GHSA-v38p-mqq3-m6v5

GHSA-v38p-mqq3-m6v5

Keycloak Reflected XSS

Source: GitHub Advisory Database (reviewed) Moderate CVE-2017-12158

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-parent < 3.4.0 3.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

References

External links from the advisory. They lead to third-party sites.