VULNERABILITY INTELLIGENCE

CVE-2019-18211

CVSS score8.8 HIGH
EPSS probability2.56%
CISA KEVNot currently listed
Published2019-12-23
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to unvalidated deserialization of wrapped BinaryFormatter payloads, leading to arbitrary remote code execution for any low-privilege user.

Weakness classification

  • CWE-502: Deserialization of Untrusted Data

Primary references