Deserialization of Untrusted Data
Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.
Advisories for Maven/Ro.pippo/Pippo-Core package
2022
2018
Improper Restriction of XML External Entity Reference
jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.
Deserialization of Untrusted Data
An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPO_SESSION field of a cookie. Sending this cookie may lead to remote code execution.