GHSA-c2fp-mpmm-cqxv

    Dashboard / Vulnerabilities / GHSA-c2fp-mpmm-cqxv

    GHSA-c2fp-mpmm-cqxv

    Published: 17 May 2022Last Modified: 21 Dec 2023
    Aliases:
    CVE-2014-1202

    Summary: Code injection via property expansion in SoapUI

    Details: The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.

    References: https://nvd.nist.gov/vuln/detail/CVE-2014-1202, https://github.com/SmartBear/soapui/commit/6373165649ad74257493c69dbc0569caa7e6b4a6, https://github.com/SmartBear/soapui, https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt, http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html, http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html, http://www.exploit-db.com/exploits/30908

    Affected packages

    Package

    Name: com.smartbear.soapui:soapui

    Purl: pkg:maven/com.smartbear.soapui/soapui

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -4.6.4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-c2fp-mpmm-cqxv | CVE-DB