CVE-2017-2582

CVE-2017-2582 describes a vulnerability in Keycloak versions prior to 2.5.1, as well as Red Hat Enterprise Linux and JBoss EAP, where the StaxParserUtil class improperly handles SAML message parsing. An authenticated attacker could exploit this by crafting a SAML request ID field to reveal system property values in the "InResponseTo" field of the response. This medium-severity vulnerability (CVSS 6.5) allows for information disclosure (CWE-200, CWE-201) with high confidentiality impact, but does not affect integrity or availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.