CVE-2022-39256

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

Orckestra C1 CMS is a .NET based Web Content Management System. A vulnerability in versions prior to 6.13 allows remote attackers to execute arbitrary code on affected installations of Orckestra C1 CMS. Authentication is required to exploit this vulnerability. The authenticated user may perform the actions unknowingly by visiting a specially crafted site. This issue is patched in C1 CMS v6.13. There are no known workarounds.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Orckestra	C1-CMS-Foundation	< 6.13

References

https://github.com/Orckestra/C1-CMS-Foundation/pull/814Patch, Third Party Advisory
https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13Release Notes, Third Party Advisory
https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838jThird Party Advisory
https://github.com/Orckestra/C1-CMS-Foundation/pull/814Patch, Third Party Advisory
https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.13Release Notes, Third Party Advisory
https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-gfhp-jgp6-838jThird Party Advisory

Timeline

Published: Sep 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-392577.5Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a maliciou CVE-2022-392588.2mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spo CVE-2022-392595.5jadx is a set of command line and GUI tools for producing Java source code from Android Dex and Apk files. versions prior to 1.4.5 are subje CVE-2022-39266.5The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could all CVE-2022-392608.8Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement CVE-2022-392617.5Twig is a template language for PHP. Versions 1.x prior to 1.44.7, 2.x prior to 2.15.3, and 3.x prior to 3.4.3 encounter an issue when the f CVE-2022-392624.8GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can def CVE-2022-392638.1`@next-auth/upstash-redis-adapter` is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications tha CVE-2022-392645.9nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious CVE-2022-392657.2MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting CVE-2022-392669.8isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 CVE-2022-392678.8Bifrost is a heterogeneous middleware that synchronizes MySQL, MariaDB to Redis, MongoDB, ClickHouse, MySQL and other services for productio