Description

The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.

Remediation

References

http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html

https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt

http://www.exploit-db.com/exploits/30908

http://www.youtube.com/watch?v=3lCLE64rsc0

http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html

Related Vulnerabilities

CVE-2018-16481 Vulnerability in npm package html-pages

CVE-2018-14732 Vulnerability in maven package org.webjars.npm:webpack-dev-server

CVE-2019-19729 Vulnerability in npm package bson-objectid

CVE-2019-11002 Vulnerability in npm package materialize-css

CVE-2022-31129 Vulnerability in npm package moment

Severity

Critical

Classification

CWE-94

Tags

Exploit