CVE-2022-39256
Critical
Description
Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.
SeverityCritical
CVSS9.0
Exploit probability—
Product
Orckestra C1 Cms
PublishedSep 27, 2022
First seenSep 27, 2022
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- orckestra c1_cms6.13 or later
- CompositeC1.Core6.13 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| orckestra c1_cms | v < 6.13 | 6.13 |
| CompositeC1.CoreNuGet | v < 6.13 | 6.13 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.