Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

gSOAP 2.8.107 lets attackers run code

CVE-2020-13576 · published 5 years ago
Summary

The WS-Addressing feature in Genivia gSOAP version 2.8.107 can be tricked by a specially crafted web service request to run arbitrary code on the server. This means an attacker could take control of the affected system. Update to a newer gSOAP package or apply the vendor's patch, and consider filtering or blocking unexpected SOAP traffic.

What to do
  • Update debian gsoap to version 2.8.104-3.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian gsoap < 2.8.104-3
Fix: upgrade to 2.8.104-3
Debian:13 debian gsoap < 2.8.104-3
Fix: upgrade to 2.8.104-3
Debian:14 debian gsoap < 2.8.104-3
Fix: upgrade to 2.8.104-3
– genivia gsoap 2.8.107
cpe:2.3:a:genivia:gsoap:2.8.107:*:*:*:*:*:*:*
– fedoraproject fedora 33
34
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Original advisory text
A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an...
A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
References
Severity
9.8 Critical
Exploitation
6% chance of attack within 30 days
Type
CWE-680Integer Overflow to Buffer Overflow
CWE-190Integer Overflow
Timeline
Published10 Feb 2021
Updated2 Nov 2026
First seen11 Sep 2026
Sources
DEBIAN-CVE-2020-13576 · OSV
CVE-2020-13576 · NVD
Track software like this
Free during beta