VULNERABILITY INTELLIGENCE

CVE-2017-12161

CVSS score8.8 HIGH

EPSS probability1.31%

CISA KEVNot currently listed

Published2018-02-21

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks.

Weakness classification

CWE-602: Client-Side Enforcement of Server-Side Security
CWE-640: Weak Password Recovery Mechanism for Forgotten Password

Primary references

secalert@redhat.com — Issue Tracking, Third Party Advisory
secalert@redhat.com — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory