Description

The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.

Remediation

References

http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html

http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html

http://www.exploit-db.com/exploits/30908

http://www.youtube.com/watch?v=3lCLE64rsc0

https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt

Related Vulnerabilities

CVE-2023-24057 Vulnerability in maven package ca.uhn.hapi.fhir:org.hl7.fhir.utilities

CVE-2022-41376 Vulnerability in npm package metro4

CVE-2022-31110 Vulnerability in npm package rsshub

CVE-2022-3224 Vulnerability in npm package parse-url

CVE-2018-3720 Vulnerability in npm package assign-deep

Severity

Critical

Classification

CWE-94

Tags

Exploit