CVE-2017-12158
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource loca
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
MEDIUM · CVSS 5.4
EPSS 0.00668
Monitor
- No active-exploitation, high-EPSS, or public-exploit signals - routine patching cadence
Sigma rules0
YARA rules0