Description
The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized Java data.
Remediation
References
http://www.openwall.com/lists/oss-security/2017/05/22/2
https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true
Related Vulnerabilities
CVE-2019-5480 Vulnerability in npm package statichttpserver
CVE-2023-30522 Vulnerability in maven package org.jenkins-ci.plugins:fogbugz
CVE-2019-10247 Vulnerability in maven package org.eclipse.jetty:jetty-server
CVE-2019-10332 Vulnerability in maven package org.jenkins-ci.plugins:electricflow
CVE-2022-45210 Vulnerability in maven package org.jeecgframework.boot:jeecg-module-system