Vulnerability CVE-2020-12835
Published: 2020-05-20

Description:
An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network Licensing Protocol component.

See advisories in our WLB2 database:
Topic
Author
Date
High
Protection Licensing Toolkit ReadyAPI 3.2.5 Code Execution / Deserialization
Moritz Bechler
20.05.2020

Type:

CWE-74

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Smartbear -> Readyapi 

 References:
http://packetstormsecurity.com/files/157772/Protection-Licensing-Toolkit-ReadyAPI-3.2.5-Code-Execution-Deserialization.html
http://seclists.org/fulldisclosure/2020/May/38
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-039.txt
https://www.syss.de/pentest-blog/
Copyright 2024, cxsecurity.com

 

Back to Top