Paper/Archive/CVE-2022-39256

CVE-2022-39256

Orckestra C1-CMS-Foundation — Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 76.7.767 × 2015.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.

Affected

ProductAffectedFixed inSource

C1-CMS-Foundation< 6.13–CNA

Scores by source

GitHub_M (CNA)9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838j refgithub.com/Orckestra/C1-CMS-Foundation/pull/814 refgithub.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13