CVE-2020-26118 - CVE House
Back to Database
Status published High CVE-2020-26118

In SmartBear Collaborator Server through 13.3.13302, use of the Google...

Vulnerability Description

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious object can be submitted to the server via an authenticated attacker to execute commands on the underlying system.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-26118

Credits & Attribution

No credits recorded in the NVD database.

References

More from smartbear

View All →
CVE-2021-46708
The swagger-ui-dist package before 4.1.3 for Node.js could allow a...
Medium 6.1
CVE-2021-41657
SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in...
Medium 6.1
CVE-2020-12835
An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5....
Critical 9.8
CVE-2019-17495
A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI...
Critical 9.8
CVE-2019-12180
An issue was discovered in SmartBear ReadyAPI through 2.8.2 and...
High 7.8

Affected Vendor

Affected Software

collaborator
Vulnerable Versions:
0

Timeline

Official Publish: January 11th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.