High severity · published Jun 12, 2019
CVE-2019-5442
XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Pippo · Pippo
1.12.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-5442
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-5442
Exploit
https://hackerone.com/reports/506791
More from Pippo
9.8
CVE-2018-20059
jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE
9.8
CVE-2018-18628
An issue was discovered in Pippo 1.11.0
9.8
CVE-2017-18349
parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request,…
9.8
CVE-2018-18240
Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection…