CVE-2020-26118: Critical severity smartbear collaborator vulnerability
In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious object can be submitted to the server via an authenticated attacker to execute commands on the underlying system.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-26118?
CVE-2020-26118 is a vulnerability in SmartBear Collaborator Server through 13.3.13302 that allows for a post-authentication Java deserialization attack.
How severe is CVE-2020-26118?
CVE-2020-26118 has a severity rating of 8.8 (Critical).
Which software versions are affected by CVE-2020-26118?
Versions up to and including 13.3.13302 of SmartBear Collaborator are affected by CVE-2020-26118.
How can I mitigate CVE-2020-26118?
To mitigate CVE-2020-26118, update SmartBear Collaborator Server to a version later than 13.3.13302.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-26118?
The CWE ID for CVE-2020-26118 is CWE-502 (Deserialization of Untrusted Data).