critical9.3Public exploit code
CVE-2014-1202
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SoapUI 4.6.3 - Remote Code Execution2014-01-14 · remote · windows
Impact
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eviware | Soapui | Versions 2.5.1, 3.0.1, 3.5, 3.5.1, 3.6, 3.6.1 |
| Smartbear | Soapui | through 4.6.3 Versions 4.0, 4.0.1, 4.5, 4.5.1, 4.5.2 |
Weakness classification
References
- NVD record
- CVE.org record
- http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html
- http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html
- http://www.exploit-db.com/exploits/30908
- http://www.youtube.com/watch?v=3lCLE64rsc0
- https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt
- http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html
- http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html
- http://www.exploit-db.com/exploits/30908
- http://www.youtube.com/watch?v=3lCLE64rsc0
- https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt