TI-2018-12890 Aliases CVE-2018-18240 GHSA-h892-x453-86wc

Pippo through 1.11.0 allows remote code execution via a command to…

MEDIUM 48CWE-502Published 2018-10-11 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.

Why it matters now

EPSS 0.03653 89th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed ro.pippo:pippo-core (Maven): 1.12.0ro.pippo:pippo-session (Maven): 1.12.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	ro.pippo:pippo-core (Maven)	before 1.12.0	1.12.0	Patch available	GHSA-h892-x453-86wc
—	ro.pippo:pippo-session (Maven)	before 1.12.0	1.12.0	Patch available	GHSA-h892-x453-86wc

— Vendor— Affected all versions Fixed in — No fix listed CNA
ro.pippo:pippo-core (Maven) Vendor— Affected before 1.12.0 Fixed in 1.12.0 Patch available GHSA-h892-x453-86wc
ro.pippo:pippo-session (Maven) Vendor— Affected before 1.12.0 Fixed in 1.12.0 Patch available GHSA-h892-x453-86wc

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pippo:pippo::::::::	up to 1.11.0	Vulnerable	Pippo

cpe:2.3:a:pippo:pippo:*:*:*:*:*:*:*:* Versions up to 1.11.0 Vulnerable ·Pippo

Remediation

Fix · GHSA-h892-x453-86wc ro.pippo:pippo-core (Maven) Fixed in 1.12.0 Advisory →
Fix · GHSA-h892-x453-86wc ro.pippo:pippo-session (Maven) Fixed in 1.12.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2018-18240
2026-10-03 Alias added: GHSA-h892-x453-86wc

References

Exploit 1

https://github.com/pippo-java/pippo/issues/454

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2018-18240

Other 2

TI-2017-13524 parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and… CVSS 3.0CRITICAL 9.8
TI-2018-13168 An issue was discovered in Pippo 1.11.0. CVSS 3.0CRITICAL 9.8
TI-2018-14220 jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE. CVSS 3.0CRITICAL 9.8
TI-2019-03850 XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences