CVE-2022-24789

C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery (SSRF) by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. The attacker may also truncate arbitrary files to zero size (effectively delete them) leading to denial of service (DoS) or altering application logic. The authenticated user may unknowingly perform the actions by visiting a specially crafted site. Patched in C1 CMS v6.12, no known workarounds exist.

• CWE-918

• https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.12Release Notes, Third Party Advisory
• https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-j9c2-gr6m-pp45Third Party Advisory
• https://github.com/Orckestra/C1-CMS-Foundation/releases/tag/v6.12Release Notes, Third Party Advisory
• https://github.com/Orckestra/C1-CMS-Foundation/security/advisories/GHSA-j9c2-gr6m-pp45Third Party Advisory

Published

Mar 28, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-24783Deno is a runtime for JavaScript and TypeScript. The version…10
• CVE-2022-24784Statamic is a Laravel and Git powered CMS. Before versions 3…3.7
• CVE-2022-24785Moment.js is a JavaScript date library for parsing, validati…7.5
• CVE-2022-24786PJSIP is a free and open source multimedia communication lib…9.8
• CVE-2022-24787Vyper is a Pythonic Smart Contract Language for the Ethereum…7.5
• CVE-2022-24788Vyper is a pythonic Smart Contract Language for the ethereum…9.8
• CVE-2022-2479Insufficient validation of untrusted input in File in Google…4.3
• CVE-2022-24790Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 se…7.5
• CVE-2022-24791Wasmtime is a standalone JIT-style runtime for WebAssembly, …9.8
• CVE-2022-24792PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24793PJSIP is a free and open source multimedia communication lib…7.5
• CVE-2022-24794Express OpenID Connect is an Express JS middleware implement…6.1