Remote Code Execution

Pippo is vulnerable to remote code execution attacks. A remote, unauthenticated attacker could create a malicious object, base64 encode it, and place it in the PIPPOSESSION field of a cookie to exploit the flawed Cookie Handler component causing denial of service conditions. Affected by this issu...

Deserialization of Untrusted Data in Pippo

An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode calls ObjectInputStream.readObject to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPOSESSION...

Design/Logic Flaw

An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode calls ObjectInputStream.readObject to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPOSESSION...