{"id":"GHSA-xjrr-xv9m-4pw5","summary":"Improper Input Validation in alilibaba:fastjson","details":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.","aliases":["CVE-2017-18349"],"modified":"2024-02-16T07:59:10.562257Z","published":"2018-10-24T19:42:03Z","database_specific":{"cwe_ids":["CWE-20"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2020-06-16T22:03:42Z","nvd_published_at":null},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18349"},{"type":"WEB","url":"https://github.com/pippo-java/pippo/issues/466"},{"type":"WEB","url":"https://github.com/pippo-java/pippo/commit/8443377d3c5b35acca190a66894b4f95e4051be2"},{"type":"WEB","url":"https://fortiguard.com/encyclopedia/ips/44059"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xjrr-xv9m-4pw5"},{"type":"PACKAGE","url":"https://github.com/alibaba/fastjson"},{"type":"WEB","url":"https://github.com/alibaba/fastjson/wiki/security_update_20170315"}],"affected":[{"package":{"name":"com.alibaba:fastjson","ecosystem":"Maven","purl":"pkg:maven/com.alibaba/fastjson"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.31"}]}],"versions":["1.1.15","1.1.16","1.1.17","1.1.18","1.1.19","1.1.20","1.1.21","1.1.22","1.1.23","1.1.24","1.1.25","1.1.26","1.1.27","1.1.28","1.1.29","1.1.30","1.1.31","1.1.31.sec01","1.1.31.sec04","1.1.31.sec06","1.1.31.sec07","1.1.31.sec10","1.1.31_noneautotype","1.1.32","1.1.33","1.1.33.android","1.1.33.sec01","1.1.33.sec04","1.1.33.sec06","1.1.33.sec10","1.1.34","1.1.34.android","1.1.34.sec01","1.1.34.sec04","1.1.34.sec06","1.1.34.sec09","1.1.34.sec10","1.1.34_noneautotype","1.1.35","1.1.36","1.1.37","1.1.38","1.1.39","1.1.40","1.1.41","1.1.41.sec01","1.1.41.sec04","1.1.41.sec06","1.1.41.sec10","1.1.42","1.1.42.android","1.1.43","1.1.43.android","1.1.44","1.1.44.android","1.1.45","1.1.45.android","1.1.46","1.1.46.android","1.1.46.sec01","1.1.46.sec04","1.1.46.sec06","1.1.46.sec09","1.1.46.sec10","1.1.46_noneautotype","1.1.47.android","1.1.48.android","1.1.49.android","1.1.50.android","1.1.51.android","1.1.52.android","1.1.53.android","1.1.54.android","1.1.55.android","1.1.56.android","1.1.57.android","1.1.58.android","1.1.59.android","1.1.60.android","1.1.61.android","1.1.62.android","1.1.63.android","1.1.64.android","1.1.65.android","1.1.66.android","1.1.67.android","1.1.68.android","1.1.69.android","1.1.70.android","1.1.70.android_noneautotype","1.1.71.android","1.1.72.android","1.1.73.android","1.1.76.android","1.1.76.android_noneautotype","1.1.77.android_noneautotype","1.2.0","1.2.1","1.2.10","1.2.11","1.2.12","1.2.13","1.2.13.sec01","1.2.14","1.2.14.sec01","1.2.14.sec10","1.2.15","1.2.16","1.2.16.sec01","1.2.16.sec04","1.2.16.sec10","1.2.17","1.2.18","1.2.19","1.2.2","1.2.2.sec01","1.2.2.sec10","1.2.20","1.2.21","1.2.22","1.2.23","1.2.24","1.2.25","1.2.25.sec10","1.2.26","1.2.27","1.2.27.sec06","1.2.27.sec09","1.2.27.sec10","1.2.28","1.2.28.odps","1.2.29","1.2.29.sec04","1.2.29.sec06","1.2.29.sec09","1.2.29.sec10","1.2.3","1.2.30","1.2.4","1.2.4.sec01","1.2.4.sec04","1.2.4.sec09","1.2.4.sec10","1.2.5","1.2.6","1.2.7","1.2.7.sec01","1.2.7.sec04","1.2.7.sec06","1.2.7.sec09","1.2.7.sec10","1.2.8","1.2.8.sec01","1.2.8.sec04","1.2.8.sec05","1.2.8.sec06","1.2.8.sec09","1.2.8.sec10","1.2.8.sec10_noneautotype","1.2.8_noneautotype","1.2.9"],"database_specific":{"last_known_affected_version_range":"\u003c= 1.2.24","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-xjrr-xv9m-4pw5/GHSA-xjrr-xv9m-4pw5.json"}},{"package":{"name":"ro.pippo:pippo-fastjson","ecosystem":"Maven","purl":"pkg:maven/ro.pippo/pippo-fastjson"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0"}]}],"versions":["0.10.0","0.4.0","0.4.1","0.4.2","0.5.0","0.6.0","0.6.1","0.7.0","0.8.0","0.9.0","0.9.1","1.0.0","1.1.0","1.10.0","1.11.0","1.2.0","1.3.0","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-xjrr-xv9m-4pw5/GHSA-xjrr-xv9m-4pw5.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}