CVE-2018-18240

2018-10-1107:29:00

Google

osv.dev

7.8 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.9%

JSON

Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream’s available protection mechanisms to restrict unmarshalling.

CPENameOperatorVersion
pippoeqpippo-parent-0.3.0
pippoeqrelease-1.9.0
pippoeqrelease-1.8.0
pippoeqrelease-1.11.0
pippoeqrelease-0.7.0
pippoeqrelease-0.6.0
pippoeqpippo-parent-0.2.0
pippoeqrelease-0.9.0
pippoeqrelease-1.7.0
pippoeqrelease-1.3.0

Name	Operator	Version
pippo	eq	pippo-parent-0.3.0
pippo	eq	release-1.9.0
pippo	eq	release-1.8.0
pippo	eq	release-1.11.0
pippo	eq	release-0.7.0
pippo	eq	release-0.6.0
pippo	eq	pippo-parent-0.2.0
pippo	eq	release-0.9.0
pippo	eq	release-1.7.0
pippo	eq	release-1.3.0