Skip to content
Fencer Vulns
medium 4.7

HSEC-2024-0001 json

Reflected XSS vulnerability in keter

published 2025-11-14 11 mo ago modified 2025-11-14 11 mo ago

cvss
4.7
version 3.1, OSV
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

# Reflected XSS vulnerability in keter

Keter is an app-server/reverse-proxy often used with webapps build on Yesod web-framework.

In the logic handling VHost dispatch, Keter was echoing back `Host` header value, unescaped, as part of an HTML error page. This constitutes a reflected-XSS vulnerability. Although not readily exploitable directly from a browser (where `Host` header can't generally assume arbitrary values), it may become such in presence of further weaknesses in components upstream of Keter in the http proxying chain. Therefore, AC:High in CVSS evaluation.

Patch / fix

  • hackage keter 1.8.4

CVSS scores

assigned by version score vector
OSV 3.1 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
hackage keter
>=0.3.4, <1.8.4
1.8.4

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.