CVE-2013-2185: Arbitrary file upload via deserialization

January 19, 2014 (updated November 1, 2016)

A remote attacker able to supply a serialized instance of the DiskFileItem class, which will be deserialized on a server, could use this flaw to write arbitrary content to any location on the server that is permitted by the user running the application server process.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2185

Detect and mitigate CVE-2013-2185 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →