CVE-2017-12158: keycloak
Vulnerability summary
CVE-2017-12158 is a medium (CVSS 5.4) vulnerability in keycloak. EPSS estimates a 1.02% chance of exploitation in the next 30 days, higher than 63.4% of scored vulnerabilities.
Not severe (CVSS 5.4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 26-10-2017PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · WolfiEcosystem advisory · calculated5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- OSV · MavenEcosystem advisory · calculated5.4MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.02%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.02% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-444Inconsistent Interpretation of HTTP RequestsThe product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
- CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard7 products
- keycloakAll versions (No fix recorded)
- keycloak-26.2All versions (No fix recorded)
- keycloak-26.4All versions (No fix recorded)
- keycloak-26.5All versions (No fix recorded)
- keycloak-26.6All versions (No fix recorded)
Wolfi4 products
- keycloakAll versions (No fix recorded)
- keycloak-26.4All versions (No fix recorded)
- keycloak-26.5All versions (No fix recorded)
- keycloak-26.6All versions (No fix recorded)
Keycloak1 product
- keycloakna
Org.keycloak1 product
- keycloak-parent< 3.4.0
Red hat, inc.1 product
- keycloak3.4.0
Redhat1 product
- single_sign_on7.0 | 7.1
6 vendors · 15 products
References
7 links- access.redhat.com/errata/RHSA-2017:2904Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2905Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2906Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisoryWEB
