CVE-2018-18240

CVE-2018-18240

Published · Updated

Follow this CVE+ Monitor ro.pippo:pippo-core+ Monitor ro.pippo:pippo-session

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 3.7%
Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.
Affected products
n/a · n/a