Vulnerability Details CVE-2017-18349
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.908
EPSS Ranking 99.6%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 10.0
References
- https://fortiguard.com/encyclopedia/ips/44059
- https://github.com/alibaba/fastjson/wiki/security_update_20170315
- https://github.com/pippo-java/pippo/issues/466
- https://fortiguard.com/encyclopedia/ips/44059
- https://github.com/alibaba/fastjson/wiki/security_update_20170315
- https://github.com/pippo-java/pippo/issues/466
Products affected by CVE-2017-18349
-
cpe:2.3:a:alibaba:fastjson:-
-
cpe:2.3:a:alibaba:fastjson:1.1.157
-
cpe:2.3:a:alibaba:fastjson:1.1.20
-
cpe:2.3:a:alibaba:fastjson:1.1.21
-
cpe:2.3:a:alibaba:fastjson:1.1.22
-
cpe:2.3:a:alibaba:fastjson:1.1.23
-
cpe:2.3:a:alibaba:fastjson:1.1.25
-
cpe:2.3:a:alibaba:fastjson:1.1.26
-
cpe:2.3:a:alibaba:fastjson:1.1.27
-
cpe:2.3:a:alibaba:fastjson:1.1.31
-
cpe:2.3:a:alibaba:fastjson:1.1.32
-
cpe:2.3:a:alibaba:fastjson:1.1.33
-
cpe:2.3:a:alibaba:fastjson:1.1.34
-
cpe:2.3:a:alibaba:fastjson:1.1.35
-
cpe:2.3:a:alibaba:fastjson:1.1.36
-
cpe:2.3:a:alibaba:fastjson:1.1.42
-
cpe:2.3:a:alibaba:fastjson:1.1.43
-
cpe:2.3:a:alibaba:fastjson:1.1.44
-
cpe:2.3:a:alibaba:fastjson:1.1.45
-
cpe:2.3:a:alibaba:fastjson:1.1.46
-
cpe:2.3:a:alibaba:fastjson:1.2.0
-
cpe:2.3:a:alibaba:fastjson:1.2.1
-
cpe:2.3:a:alibaba:fastjson:1.2.10
-
cpe:2.3:a:alibaba:fastjson:1.2.12
-
cpe:2.3:a:alibaba:fastjson:1.2.13
-
cpe:2.3:a:alibaba:fastjson:1.2.14
-
cpe:2.3:a:alibaba:fastjson:1.2.15
-
cpe:2.3:a:alibaba:fastjson:1.2.16
-
cpe:2.3:a:alibaba:fastjson:1.2.17
-
cpe:2.3:a:alibaba:fastjson:1.2.18
-
cpe:2.3:a:alibaba:fastjson:1.2.19
-
cpe:2.3:a:alibaba:fastjson:1.2.2
-
cpe:2.3:a:alibaba:fastjson:1.2.20
-
cpe:2.3:a:alibaba:fastjson:1.2.21
-
cpe:2.3:a:alibaba:fastjson:1.2.22
-
cpe:2.3:a:alibaba:fastjson:1.2.23
-
cpe:2.3:a:alibaba:fastjson:1.2.24
-
cpe:2.3:a:alibaba:fastjson:1.2.4
-
cpe:2.3:a:alibaba:fastjson:1.2.6
-
cpe:2.3:a:alibaba:fastjson:1.2.7
-
cpe:2.3:a:alibaba:fastjson:1.2.8
-
cpe:2.3:a:alibaba:fastjson:1.2.9
-
cpe:2.3:a:pippo:pippo:1.11.0