CVE-2013-2185: Arbitrary file upload via deserialization

January 19, 2014 (updated November 1, 2016)

A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is permitted by the user running the application server process.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2185

Code Behaviors & Features

Detect and mitigate CVE-2013-2185 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →