Loading...
Skip to main content
GeekWala

CVE-2022-24789 — Server side request forgery in C1CMS.Assemblies —...

HIGH

Server side request forgery in C1 CMS

Published March 30, 2022Updated October 14, 2025Source: osv

Summary

C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery (SSRF) by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. The attacker may also truncate arbitrary files to zero size (effectively delete them) leading to denial of service (DoS) or altering application logic. The authenticated user may unknowingly perform the actions by visiting a specially crafted site. Patched in C1 CMS v6.12, no known workarounds exist.

Advisory Timeline

  • First published March 30, 2022 (1658 days ago).
  • Last revised October 14, 2025 — 1295 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update C1CMS.Assemblies to 6.12.8122.18346 or later
dotnet add package C1CMS.Assemblies --version 6.12.8122.18346

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: nuget (1).

PackageEcosystemAffectedFixed In
C1CMS.Assemblies
nuget
6.0.6248.33161, 6.1.6325.31805, 6.10.7583.21856, 6.11.7982.26191 (+8 more)6.12.8122.18346

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-918
    Server-Side Request Forgery (SSRF)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.6 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

References

Frequently Asked Questions

What is CVE-2022-24789?
Server side request forgery in C1 CMS This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.6/10).
How do I check if my project is affected by CVE-2022-24789?
CVE-2022-24789 affects C1CMS.Assemblies. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-24789 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
7.6

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-8pp6-8x4q-c5mx
GHSA-j9c2-gr6m-pp45

Related CVEs

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies