CVE-2020-1714

Published: May 13, 2020Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.

Affected (7)

Products: Redhat: Keycloak, Decision Manager, Jboss Fuse, Openshift Application Runtimes, Process Automation, Single Sign On · Quarkus: Quarkus

6 products

Openshift Application Runtimes

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Keycloak	Before 11.0.0

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Redhat Decision Manager	Version 7.0
Redhat Jboss Fuse	Version 7.0.0
Redhat Openshift Application Runtimes	All versions
Redhat Process Automation	Version 7.0
Redhat Single Sign On	Version 7.0