CVE-2018-18628: Critical severity pippo vulnerability
An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPOSESSION field of a cookie. Sending this cookie may lead to remote code execution.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2018-18628.
What is the severity rating of CVE-2018-18628?
The severity rating of CVE-2018-18628 is 9.8, which is classified as critical.
What is the affected software version of CVE-2018-18628?
The affected software version of CVE-2018-18628 is Pippo 1.11.0.
How does the vulnerability CVE-2018-18628 work?
The vulnerability CVE-2018-18628 allows an attacker to deserialize a malicious object using the function SerializationSessionDataTranscoder.decode() in Pippo 1.11.0, which can lead to arbitrary code execution.
Is there a fix available for CVE-2018-18628?
At the moment, there is no known fix available for CVE-2018-18628. It is recommended to upgrade to a newer version when a fix becomes available.