Datavane TIS Unrestricted File Upload and Deserialization Vulnerability

A vulnerability exists in Datavane TIS versions prior to 4.3.0, allowing unrestricted upload of files with dangerous types and deserialization of untrusted data. This issue arises from inadequate security measures in the handling of XML files, specifically in the XStream library, which could lead to remote code execution by allowing the deserialization of arbitrary classes.

Impact

Exploitation of this vulnerability could result in remote code execution on the server where Datavane TIS is running.

Remediation

Users can update to Datavane TIS version 4.3.0 or later to address this vulnerability.