CVE-2020-26118

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization…

High · published January 11, 2021

CVSS v3.1
8.8
EPSS
4%
Percentile
90.0
In the wild
Unconfirmed
What it is

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious object can be submitted to the server via an authenticated attacker to execute commands on the underlying system.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.03807 · 90.0th percentile
Published
2021-01-11T14:53Z
EPSS history
Timeline
  • 11 JAN 14:53Z
    In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization…
    cvelistv5