CVE-2020-12835: Critical severity smartbear readyapi vulnerability

Published May 20, 2020

Updated

An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network Licensing Protocol component.

Affected Software

1 affected component

SMARTBEAR ReadyAPI=3.2.5

Event History

May 20, 2020

CVE Published

via MITRE·01:01 PM

Data Sourced

via MITRE·01:01 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this issue in SmartBear ReadyAPI SoapUI Pro 3.2.5?

The vulnerability ID for this issue in SmartBear ReadyAPI SoapUI Pro 3.2.5 is CVE-2020-12835.

What is the severity level of CVE-2020-12835?

CVE-2020-12835 has a severity level of critical with a CVSS score of 9.8.

What is the affected software and version of CVE-2020-12835?

The affected software and version of CVE-2020-12835 is SmartBear ReadyAPI SoapUI Pro 3.2.5.

What is the description of CVE-2020-12835?

CVE-2020-12835 is a vulnerability in SmartBear ReadyAPI SoapUI Pro 3.2.5 that allows an attacker to inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network Licensing.

Are there any known references for CVE-2020-12835?

Yes, there are references available for CVE-2020-12835. Some of the references include: http://packetstormsecurity.com/files/157772/Protection-Licensing-Toolkit-ReadyAPI-3.2.5-Code-Execution-Deserialization.html, http://seclists.org/fulldisclosure/2020/May/38, https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-039.txt