Vulnerability · Published Sep 27, 2022 · Assigned by GitHub_M
CVE-2022-39256Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.
Critical 9.0
In plain English
A critical-severity unsafe deserialization in C1-CMS-Foundation from Orckestra. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| NuGet | compositec1.core | 6.13 | GHSA-gfhp-jgp6-838j |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Orckestra | C1-CMS-Foundation | < 6.13 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838j x_refsource_CONFIRM
- https://github.com/Orckestra/C1-CMS-Foundation/pull/814 x_refsource_MISC
- https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13 x_refsource_MISC