GoogleOSV:GHSA-C2FP-MPMM-CQXVCode injection via property expansion in SoapUI
7.6 High
AI Score
Confidence
Low
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.838 High
EPSS
Percentile
98.4%
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
References
baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html
packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html
www.exploit-db.com/exploits/30908
github.com/SmartBear/soapui
github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt
github.com/SmartBear/soapui/commit/6373165649ad74257493c69dbc0569caa7e6b4a6
nvd.nist.gov/vuln/detail/CVE-2014-1202
Related
7.6 High
AI Score
Confidence
Low
9.3 High
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
0.838 High
EPSS
Percentile
98.4%