GHSA-7fm6-2qw4-g3x3
Suggest an improvement- Source
- https://github.com/advisories/GHSA-7fm6-2qw4-g3x3
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-7fm6-2qw4-g3x3/GHSA-7fm6-2qw4-g3x3.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-7fm6-2qw4-g3x3
- Aliases
- Published
- 2018-10-24T19:46:20Z
- Modified
- 2024-03-04T22:31:00.772605Z
- Severity
-
- 9.8 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Deserialization of Untrusted Data in Pippo
- Details
-
An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPO_SESSION field of a cookie. Sending this cookie may lead to remote code execution.
- Database specific
{ "nvd_published_at": null, "cwe_ids": [ "CWE-502" ], "github_reviewed_at": "2020-06-16T21:22:35Z", "severity": "CRITICAL", "github_reviewed": true }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2018-18628
- https://github.com/pippo-java/pippo/issues/458
- https://github.com/pippo-java/pippo/commit/a82347d9d3358e98c89b48579d4285d807a57cc0
- https://github.com/pippo-java/pippo/commit/c6b26551a82d2dd32097fcb17c13c3b830916296
- https://github.com/advisories/GHSA-7fm6-2qw4-g3x3
- https://github.com/pippo-java/pippo
Affected packages
Maven / ro.pippo:pippo-core
Package
- Name
- ro.pippo:pippo-core
- View open source insights on deps.dev
- Purl
- pkg:maven/ro.pippo/pippo-core