Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2017-18349

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-xjrr-xv9m-4pw5

Improper Input Validation in alilibaba:fastjson parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.

gitlab/maven/com.alibaba/fastjson/CVE-2017-18349

Improper Input Validation Fastjson allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted `rmi://` URI in the `dataSourceName` field of HTTP POST data to the Pippo `/json` URI, which is mishandled in `AjaxApplication.java`.

gitlab/maven/ro.pippo/pippo-fastjson/CVE-2017-18349

Improper Input Validation parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.