CVEvulnerability
CVE-2020-12835
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2020-05-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-502
Description
An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network Licensing Protocol component.
Affected configurations
• smartbear readyapi 3.2.5
Related
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness
References
- http://packetstormsecurity.com/files/157772/Protection-Licensing-Toolkit-ReadyAPI-3.2.5-Code-Execution-Deserialization.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/May/38 Exploit, Mailing List, Third Party Advisory
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-039.txt Exploit, Third Party Advisory
- https://www.syss.de/pentest-blog/ Third Party Advisory
- http://packetstormsecurity.com/files/157772/Protection-Licensing-Toolkit-ReadyAPI-3.2.5-Code-Execution-Deserialization.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/May/38 Exploit, Mailing List, Third Party Advisory
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-039.txt Exploit, Third Party Advisory
- https://www.syss.de/pentest-blog/ Third Party Advisory