{"action":"Upgrade CompositeC1.Core to 6.13 or later.","affected":[{"fixed":"6.13","introduced":"0"}],"component":"CompositeC1.Core","cve_ids":["CVE-2022-39256"],"ecosystem":"NuGet","epss":0.01663,"exploited":false,"fixed_versions":["6.13"],"ghsa_id":"GHSA-gfhp-jgp6-838j","id":"tcs_01M5N8P4N70H9C8XT4NPZB1P5C","modified_at":"2023-11-08T04:10:16.883378Z","published_at":"2022-09-30T04:54:06Z","references":["https://osv.dev/vulnerability/GHSA-gfhp-jgp6-838j","https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838j","https://nvd.nist.gov/vuln/detail/CVE-2022-39256","https://github.com/Orckestra/C1-CMS-Foundation/pull/814","https://github.com/Orckestra/C1-CMS-Foundation/commit/af856ab5a62d19acf6aea1b1f4c6c3c4985c9446","https://github.com/Orckestra/C1-CMS-Foundation","https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-gfhp-jgp6-838j","url":"https://osv.dev/vulnerability/GHSA-gfhp-jgp6-838j"}],"summary":"Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution."}