GitHub Advisoryadvisory · Maven

GHSA-h892-x453-86wc Pippo RCE Vulnerability

CRITICAL Published 2022-05-13 Modified 2023-10-06 Official page ↗
Aliases
CVE-2018-18240
Ecosystem
Maven
Packages
ro.pippo:pippo-core, ro.pippo:pippo-session
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-07-20

Affected packages

• Maven ro.pippo:pippo-core: < 1.12.0 → fixed in 1.12.0 • Maven ro.pippo:pippo-session: < 1.12.0 → fixed in 1.12.0

Description

Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.

Related

Alias · CVE (1)

  • CVE-2018-18240 Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References