PT-2019-15278 · Orckestra · Orckestra C1 Cms

Publicado 2019-12-23 · Atualizado 2020-01-03 · CVE-2019-18211

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Orckestra C1 CMS versions prior to 6.7

Description An issue was discovered that allows arbitrary remote code execution for any low-privilege user due to unvalidated deserialization of wrapped BinaryFormatter payloads in the EntityTokenSerializer class in Composite.dll.

Recommendations For Orckestra C1 CMS versions prior to 6.7, update to version 6.7 or later to resolve the issue.

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-18211

Produtos afetados

Orckestra C1 Cms

Referências · 3

• https://github.com/Orckestra/C1-CMS-Foundation/commits/dev · Correção
• https://osv.dev/vulnerability/CVE-2019-18211 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18211 · Nota de Segurança