CVE-2022-39256: Orckestra C1 CMS Arbitrary Code Execution
Summary
CVE-2022-39256: Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution. Affects CompositeC1.Core versions < 6.13. Fixed in 6.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Orckestra C1 CMS is an open-source content management system that allows users to create and manage websites. It provides various features for content editing, publishing, and customization. The vulnerability identified as CVE-2022-39256 affects the CompositeC1.Core package, which is a core component of Orckestra C1 CMS. This package is responsible for handling deserialization of data within the CMS. The vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability, and the attack can be performed unknowingly by visiting a specially crafted site.
Vulnerability Detail
The deserialization of untrusted data in Orckestra C1 CMS's CompositeC1.Core package leads to an arbitrary code execution vulnerability. This means that an attacker can manipulate the serialized data in a way that triggers the execution of malicious code on the target system. As a result, the attacker can gain unauthorized access, perform unauthorized actions, or compromise the integrity and confidentiality of the CMS. The vulnerability has a CVSS score of 9.0, indicating its critical severity.
How To Fix
Minimum fixed version
6.13
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in Orckestra C1 CMS's CompositeC1.Core package allows for arbitrary code execution, posing a significant risk to affected installations. To mitigate this vulnerability, it is crucial to upgrade to C1 CMS v6.13 or newer, which includes the necessary patches. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for CompositeC1.Core →
FAQ
The vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. This can lead to unauthorized access, unauthorized actions, and compromise of the CMS's integrity and confidentiality.
Yes, authentication is required to exploit this vulnerability. However, the authenticated user may unknowingly perform the actions by visiting a specially crafted site.
The recommended solution is to upgrade to C1 CMS v6.13 or newer. This version includes patches that address the vulnerability and prevent arbitrary code execution.
This vulnerability was discovered and reported by Markus Wulftange from Code White GmbH.
The CWE ID associated with this vulnerability is CWE-502.
