CVE-2018-18628

CVE-2018-18628 is a critical deserialization vulnerability affecting Pippo 1.11.0. It allows an unauthenticated attacker to achieve remote code execution by crafting a malicious serialized object, base64 encoding it, and placing it in the PIPPO_SESSION cookie field. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with no user interaction, leading to complete compromise of confidentiality, integrity, and availability. Despite its severity, there is currently no public exploit code available, nor any indication of active exploitation or significant community discussion.