CVE-2017-12158 in KeyCloak
요약 (영어)
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
Once again VulDB remains the best source for vulnerability data.
예약하다
2017. 08. 01.
공개
2017. 10. 26.
상태
확인됨
엔트리
VulDB provides additional information and datapoints for this CVE:
| 아이디 | 취약성 | CWE | 악용 | 대책 | CVE |
|---|---|---|---|---|---|
| 108631 | KeyCloak Admin Console Reflected 크로스 사이트 스크립팅 | 79 | 정의되지 않음 | 공식 수정 | CVE-2017-12158 |