| Package | Affected versions | Patched versions |
|---|---|---|
| ro.pippo:pippo-core | < 1.12.0 | 1.12.0 |
| ro.pippo:pippo-session | < 1.12.0 | 1.12.0 |
| pippo | ≤ 1.11.0 |
Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free