Unscored severity · published Jan 25, 2014
CVE-2014-1202
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file
–
CVSS
7.7%
EPSS
No
On KEV
Description
The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.7% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Soapui · Eviware
2.5.1; 3.0.1; 3.5; 3.5.1; 3.6; 3.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-1202
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-1202
baraktawily.blogspot.com
http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html
Exploit
http://packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html
Exploit
http://www.exploit-db.com/exploits/30908
www.youtube.com
http://www.youtube.com/watch?v=3lCLE64rsc0
github.com
https://github.com/SmartBear/soapui/blob/master/RELEASENOTES.txt