NuGet/CompositeC1.Core CVE-2022-39256: critical 9, EPSS 1.66%

Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

Action: Upgrade CompositeC1.Core to 6.13 or later.

Affected

Fixed versions

Sources

• osv: GHSA-gfhp-jgp6-838j
• https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838j
• https://nvd.nist.gov/vuln/detail/CVE-2022-39256
• https://github.com/Orckestra/C1-CMS-Foundation/pull/814
• https://github.com/Orckestra/C1-CMS-Foundation/commit/af856ab5a62d19acf6aea1b1f4c6c3c4985c9446
• https://github.com/Orckestra/C1-CMS-Foundation
• https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13

CVE-2022-39256 · published 2022-09-30T04:54:06Z · modified 2023-11-08T04:10:16.883378Z · JSON