Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2018-18240

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-h892-x453-86wc

Pippo RCE Vulnerability Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.

gitlab/maven/ro.pippo/pippo-core/CVE-2018-18240

Deserialization of Untrusted Data Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.

gitlab/maven/ro.pippo/pippo-parent/CVE-2018-18240

Deserialization of Untrusted Data Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.

gitlab/maven/ro.pippo/pippo-session/CVE-2018-18240

Deserialization of Untrusted Data Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.