Approved changes feed: RSS · Atom
cpe:2.3:a:keycloak:keycloak:-:*:*:*:*:*:*:*
part: a version: - update: *
| Vendor | Keycloak (2e151d0e-d290-578c-ae3b-5ed33d2339e2) |
|---|---|
| Product | Keycloak (75f6f822-dcd2-5b2f-994a-7fb8ec34387a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/keycloak/keycloak |
purl2cpe | 2026-06-01 10:15:28.662296 |
pkg:maven/org.keycloak/keycloak-core |
purl2cpe | 2026-06-01 10:15:28.662297 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-12159 |
vulnerable | 2026-06-08 05:08:45.419324 |
Details available
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
Published: 2017-10-26T17:00:00.000Z
Updated: 2024-09-16T21:02:35.248Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-12158 |
vulnerable | 2026-06-08 05:08:45.418730 |
Details available
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
Published: 2017-10-26T17:00:00.000Z
Updated: 2024-09-16T23:36:41.599Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.