Tóm tắt nhanh
- CVE-2022-24789 là lỗ hổng mức CAO (CVSS 7.6) ảnh hưởng C1CMS.Assemblies, c1 cms (orckestra).
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.76%, cao hơn 55.6% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 6.12.8122.18346, 6.12 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| C1CMS.Assemblies NuGet | < 6.12.8122.18346
| 6.12.8122.18346
|
| c1 cms | < 6.12
| 6.12
|
Mô tả
C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery (SSRF) by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. The attacker may also truncate arbitrary files to zero size (effectively delete them) leading to denial of service (DoS) or altering application logic. The authenticated user may unknowingly perform the actions by visiting a specially crafted site. Patched in C1 CMS v6.12, no known workarounds exist.
Mô tả của NVD
C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery (SSRF) by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. The attacker may also truncate arbitrary files to zero size (effectively delete them) leading to denial of service (DoS) or altering application logic. The authenticated user may unknowingly perform the actions by visiting a specially crafted site. Patched in C1 CMS v6.12, no known workarounds exist.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí