Parasoft CTP 10.7.5-SNAPSHOT anonymous deserialization leads to command execution
Original title: [0day-rubbish] Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT anonymous deserialization in the database restore path to JSP command execution as uid=1000 (9.8)
Researchers say an anonymous database-restore deserialization in the em web app can run commands as uid=1000.
0day Rubbish Research Team publicly disclosed a flaw in Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT, a closed-source testing product from US vendor Parasoft. The affected component is the em web application in the vendor container image, running on Tomcat 10.1.57. The disclosure describes anonymous deserialization on the database restore path leading to JSP command execution. The snippet states no patch or CVE.
Unconfirmed: The snippet is truncated and does not confirm a CVE, patch, or real-world exploitation.
- The disclosure title rates the issue 9.8.
- Parasoft is headquartered in Monrovia, California.
- The product provides continuous testing, service virtualisation and environment management.
- The snippet does not name a fixed release.
Impact: anonymous command execution as uid=1000
| Product | Affected |
|---|---|
| Parasoft Continuous Testing Platform | 10.7.5-SNAPSHOT |
- Vendors
- Parasoft
- Products
- Continuous Testing Platform
- Organizations
- 0day Rubbish Research Team
From the original article
Posted by disclosure via Fulldisclosure on Oct 20 0day Rubbish Research Team is publicly disclosing a vulnerability in Parasoft Continuous Testing Platform 10. 7. 5-SNAPSHOT, the closed-source commercial continuous-testing, service-virtualisation and environment-management product from Parasoft, a United States software-testing vendor headquartered in Monrovia, California.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.