It was found that SoapUI would expand properties in WSDL files. A remote attacker, able to supply a WSDL file that would be processed by SoapUI, could supply arbitrary Groovy code in the property of a WSDL element. This property would be expanded, and the Groovy code executed, when the SoapUI client processed the WSDL.
External References: http://baraktawily.blogspot.com/2014/01/soapui-code-execution-vulnerability-cve.html Upstream patch commit: https://github.com/SmartBear/soapui/commit/6373165649ad74257493c69dbc0569caa7e6b4a6
Statement: Not affected. Red Hat JBoss SOA Platform 4.3 and 5.3 support the SOAPClient action, which will use the SoapUI library to make calls to external web services. However, these products use SoapUI 1.7.1, while the vulnerable property expansion feature was not introduced until SoapUI 2.5. Therefore no Red Hat products are affected by this flaw.