CVE-2022-39256

    Dashboard / Vulnerabilities / CVE-2022-39256

    CVE-2022-39256

    Published: 27 Sept 2022Last Modified: 21 Oct 2026

    Summary: Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

    Details: Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.

    References: https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39256.json, https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838j, https://nvd.nist.gov/vuln/detail/CVE-2022-39256, https://github.com/Orckestra/C1-CMS-Foundation/pull/814

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -119ff090b58ab246983618a04f9b0e696b6e6d77

    Affected versions

    v6.12

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High