CVE-2018-18628
An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPO_SESSION field of a cookie. Sending this cookie may lead to remote code execution.
- Score
- CVSS 3.0 9.8 Critical
- Status
- Modified - cve@mitre.org
- Published
- 2018-10-23
- Last modified
- 2024-09-16
- Weaknesses
- CWE-502
Affected products
References
- https://github.com/pippo-java/pippo/issues/458
