Description

The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.

Remediation

References

http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html

http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html

http://www.exploit-db.com/exploits/30908

http://www.youtube.com/watch?v=3lCLE64rsc0

https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt

Related Vulnerabilities

CVE-2021-23448 Vulnerability in npm package config-handler

CVE-2020-7616 Vulnerability in npm package express-mock-middleware

CVE-2023-40817 Vulnerability in maven package org.opencrx:opencrx-core-models

CVE-2022-40929 Vulnerability in maven package com.xuxueli:xxl-job-core

CVE-2022-4350 Vulnerability in maven package net.mingsoft:ms-mcms

Severity

Critical

Classification

CWE-94

Tags

Exploit