Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-1714

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.

Published

2020-05-13T19:15:11.987

Last Modified

2024-11-21T05:11:13.600

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

6.4

Weaknesses
  • Type: Secondary
    CWE-20
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application redhat keycloak < 11.0.0 Yes
Application redhat decision_manager 7.0 Yes
Application redhat jboss_fuse 7.0.0 Yes
Application redhat openshift_application_runtimes - Yes
Application redhat process_automation 7.0 Yes
Application redhat single_sign-on 7.0 Yes
Application quarkus quarkus ≤ 1.4.2 Yes
References