CVE-2017-18349

EPSS 39.0%◆ VulnCheck KEV

Vexday Risk Score

52Attention

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 39.0%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

23 Oct 2018Published on NVD

Recommendation: Patch as soon as possible — active exploitation confirmed.

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.

Affected products

n/a · n/a

References

https://fortiguard.com/encyclopedia/ips/44059 https://github.com/alibaba/fastjson/wiki/security_update_20170315 https://github.com/pippo-java/pippo/issues/466