Description
Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.
Remediation
References
https://mail-archives.apache.org/mod_mbox/olingo-user/201912.mbox/%3CCAGSZ4d4vbSYaVh3aUWAvcVHK2qcFxxCZd3WAx3xbwZXskPX8nw%40mail.gmail.com%3E
Related Vulnerabilities
CVE-2023-49652 Vulnerability in maven package org.jenkins-ci.plugins:google-compute-engine
CVE-2022-40955 Vulnerability in maven package org.apache.inlong:manager-pojo
CVE-2019-16728 Vulnerability in maven package org.webjars.npm:dompurify
CVE-2020-7729 Vulnerability in maven package org.webjars.npm:grunt
CVE-2022-45935 Vulnerability in maven package org.apache.james:apache-james-mailbox-store