VULNERABILITY INTELLIGENCE

CVE-2020-1714

CVSS score8.8 HIGH

EPSS probability2.60%

CISA KEVNot currently listed

Published2020-05-13

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.

Weakness classification

secalert@redhat.com: CWE-20
nvd@nist.gov: CWE-20

Primary references

secalert@redhat.com — Issue Tracking, Vendor Advisory
secalert@redhat.com — Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory