CVE-2018-20059: Improper Restriction of XML External Entity Reference in pippo-core
Summary
CVE-2018-20059: Improper Restriction of XML External Entity Reference in pippo-core. Affects ro.pippo:pippo-core versions < 1.12.0. Fixed in 1.12.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pippo is a Java micro web framework that aims to be simple and lightweight. The pippo-core package is a core component of the Pippo framework, providing essential functionality for building web applications. This package is vulnerable to an XML External Entity (XXE) attack, which can lead to unauthorized access to sensitive data and remote code execution.
Vulnerability Detail
The vulnerability (CVE-2018-20059) arises from improper restriction of XML External Entity references in the jaxb/JaxbEngine.java file of the Pippo 1.11.0 version. This allows an attacker to exploit XML parsing functionality and potentially read arbitrary files or execute remote code. The impact of this vulnerability is critical, as it can lead to unauthorized access, data leakage, and compromise of the affected system.
How To Fix
Latest published version: 1.14.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a secure version of the pippo-core package.
Conclusion
The vulnerability (CVE-2018-20059) in the pippo-core package allows for XML External Entity (XXE) attacks, which can lead to unauthorized access and remote code execution. To mitigate this vulnerability, it is crucial to upgrade to version 1.12.0 or later of the pippo-core package. No known workarounds exist for this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ro.pippo:pippo-core →
FAQ
The vulnerability allows an attacker to exploit XML parsing functionality and potentially read arbitrary files or execute remote code. This can lead to unauthorized access, data leakage, and compromise of the affected system.
To fix this vulnerability, upgrade the pippo-core package to version 1.12.0 or later. This version includes the necessary fixes to properly restrict XML External Entity references.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a secure version of the pippo-core package.
Yes, this vulnerability can be exploited remotely by sending specially crafted XML payloads to the affected application.
There are no publicly known instances of this vulnerability being exploited at the time of this report. However, it is essential to apply the fix to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for ro.pippo:pippo-core.
