Code injection via property expansion in SoapUI

CRITICAL 9.3CVE-2014-1202 · GHSA-c2fp-mpmm-cqxv · Published 25/01/2014 · updated 17/06/2026

In short

CVE-2014-1202 is a CRITICAL (CVSS 9.3) vulnerability affecting com.smartbear.soapui:soapui, soapui (eviware), soapui (smartbear).
Chance of exploitation in the next 30 days (EPSS): 7.7%, higher than 94.6% of all vulnerabilities.
Fix: update to 4.6.4 or later.

Package	Affected versions	Patched versions
com.smartbear.soapui:soapui Maven	`< 4.6.4`	`4.6.4`
soapui eviware	`= 2.5.1= 3.0.1= 3.5= 3.5.1= 3.6= 3.6.1`	No fix yet
soapui smartbear	`= 4.0= 4.0.1= 4.5= 4.5.1= 4.5.2= 4.6.0= 4.6.1= 4.6.2≤ 4.6.3`	No fix yet

Description

The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.

NVD description

The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.

References

nvd.nist.gov/vuln/detail/CVE-2014-1202 · ADVISORY
SmartBear/soapui commit 6373165 · WEB
SmartBear/soapui · WEB
SmartBear/soapui · WEB
baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html · WEB
packetstormsecurity.com/files/124773/SoapUI-Remote-Code-Execution.html · WEB
exploit-db.com/exploits/30908 · WEB
youtube.com/watch

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free