In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious object can be submitted to the server via an authenticated attacker to execute commands on the underlying system.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2021-01-11T14:53:26

Updated: 2024-08-04T15:49:07.089Z

Reserved: 2020-09-27T00:00:00

Link: CVE-2020-26118

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2021-01-11T15:15:12.967

Modified: 2024-11-21T05:19:17.047

Link: CVE-2020-26118

cve-icon Redhat

No data.