← back
CVE-2019-11080

CVE-2019-11080

EPSS 14.2%
Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/46987unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.htmlhttps://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20Noteshttps://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE