PT-2017-12373 · Red Hat · Keycloak

Publicado 2017-10-26 · Atualizado 2026-05-18 · CVE-2017-12158

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak where it accepts a HOST header URL in the admin console to determine web resource locations. This could be exploited by an attacker against an authenticated user to achieve reflected XSS via a malicious server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

XSS

Enumeração de Fraquezas

CWE-444

CWE-79

Identificadores relacionados

CLEANSTART-2026-FA60324

CLEANSTART-2026-GX01236

CLEANSTART-2026-KC06018

CLEANSTART-2026-PO27799

CLEANSTART-2026-SG80587

CVE-2017-12158

GHSA-V38P-MQQ3-M6V5

RHSA-2017:2904

RHSA-2017:2905

Produtos afetados

Keycloak

Referências · 86

• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-FA60324.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SG80587.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-PO27799.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KC06018.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GX01236.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SG80587 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42577 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-fghv-69vj-qj49 · Nota
• https://access.redhat.com/errata/RHSA-2017:2905 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-H5FG-JPGR-RV9C · Nota
• https://osv.dev/vulnerability/CVE-2026-42585 · Nota
• https://osv.dev/vulnerability/CLEANSTART-2026-KC06018 · Aviso do Fabricante
• https://osv.dev/vulnerability/ghsa-5rfx-cp42-p624 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Nota de Segurança