What is GHSA-gfhp-jgp6-838j?

GHSA-gfhp-jgp6-838j is a security advisory published by GitHub Security Advisories with Critical severity. Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

Which CVE IDs does GHSA-gfhp-jgp6-838j cover?

GHSA-gfhp-jgp6-838j covers the following CVE IDs: CVE-2022-39256. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gfhp-jgp6-838j?

GHSA-gfhp-jgp6-838j has a CVSS v3 base score of 9.0, published by GitHub Security Advisories.

Which products are affected by GHSA-gfhp-jgp6-838j?

GHSA-gfhp-jgp6-838j affects 1 product, including: nuget/CompositeC1.Core:\u003c 6.13.

GHSA-gfhp-jgp6-838jCriticalCVSS 9.0

Orckestra C1 CMS's deserialization of untrusted data allows for arbitrary code execution.

Vendor

GitHub Security Advisories

Published

September 30, 2022

Last Modified

April 3, 2023

🔗 CVE IDs covered (1)

CVE-2022-39256 →

📋 Description

Impact

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site.

Patches

Patched in C1 CMS v6.13

Workarounds

Upgrade to C1 CMS v6.13 or newer is required

Credit

This issue was discovered and reported by Markus Wulftange / Code White GmbH.

🎯 Affected products1

nuget/CompositeC1.Core:< 6.13

🔗 References (6)

https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838j
https://nvd.nist.gov/vuln/detail/CVE-2022-39256
https://github.com/Orckestra/C1-CMS-Foundation/pull/814
https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13
https://github.com/Orckestra/C1-CMS-Foundation/commit/af856ab5a62d19acf6aea1b1f4c6c3c4985c9446
https://github.com/advisories/GHSA-gfhp-jgp6-838j