High severity · published May 13, 2020
CVE-2020-1714
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks
8.8
CVSS
2.6%
EPSS
No
On KEV
Description
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Decision Manager · Redhat
7.0 · source: NVD
JF
Jboss Fuse · Redhat
7.0.0 · source: NVD
KE
Keycloak · Redhat
before 11.0.0 · source: NVD
OA
Openshift Application Runtimes · Redhat
All versions, or not specified · source: NVD
PA
Process Automation · Redhat
7.0 · source: NVD
QU
Quarkus · Quarkus
through 1.4.2 · source: NVD
SS
Single Sign-on · Redhat
7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1714
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1714
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714
Patch
https://github.com/keycloak/keycloak/pull/7053
More from Quarkus
9.8
CVE-2023-6267
A flaw was found in the json payload
9.8
CVE-2022-4116
A vulnerability was found in quarkus
9.8
CVE-2022-2466
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior
9.8
CVE-2022-21724
pgjdbc is the offical PostgreSQL JDBC Driver
9.1
CVE-2024-12225
A vulnerability was found in Quarkus in the quarkus-security-webauthn module