CVE-2019-9875highunder attackCWE-502

CVE-2019-9875

Published · Updated

Follow this CVE+ Monitor CMS and Experience Platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 25%
from disclosure to weapon
Published on NVDMay 31
CISA KEV+2126d
Action required by CISAfederal deadline: 2025-04-16

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

A flaw in Sitecore's CSRF protection allows an authenticated attacker to execute arbitrary code by sending specially crafted serialized data. This happens because the system deserializes untrusted data without proper validation.

Technical detail

CWE-502 unsafe deserialization in Sitecore's anti-CSRF module permits code execution via malicious serialized .NET objects in POST parameters. Attack requires prior authentication and exploits the absence of integrity checks on deserialized payloads, leading to arbitrary code execution on the server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a