CVE-2022-39256: Deserialization of Untrusted Data

September 30, 2022

Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.

References

github.com/Orckestra/C1-CMS-Foundation/pull/814
github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13
github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838j
github.com/advisories/GHSA-gfhp-jgp6-838j
nvd.nist.gov/vuln/detail/CVE-2022-39256

Detect and mitigate CVE-2022-39256 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →