GitHub Advisoryadvisory · NuGet

GHSA-gfhp-jgp6-838j Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

CRITICAL Published 2022-09-30 Modified 2022-11-01 Official page ↗
Aliases
CVE-2022-39256
Ecosystem
NuGet
Packages
CompositeC1.Core
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2022-09-30

Affected packages

• NuGet CompositeC1.Core: < 6.13 → fixed in 6.13

Description

Impact This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. Patches Patched in C1 CMS v6.13 Workarounds Upgrade to C1 CMS v6.13 or newer is required Credit This issue was discovered and reported by Markus Wulftange / Code White GmbH.

Related

Alias · CVE (1)

  • CVE-2022-39256 Orckestra C1 CMS is a .NET based Web Content Management System. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References