PT-2019-12168 · Sitecore · Sitecore Experience Platform

Jarad Kopf · Publicado 2019-06-06 · Atualizado 2019-06-13 · CVE-2019-11080

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sitecore Experience Platform (XP) versions prior to 9.1.1

Description The issue allows remote code execution via deserialization. An authenticated user with necessary permissions can remotely execute OS commands by sending a crafted serialized object.

Recommendations For versions prior to 9.1.1, update to version 9.1.1 or later to resolve the issue.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-11080

Produtos afetados

Sitecore Experience Platform

Referências · 6

• 🔥 https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE · Exploit
• 🔥 https://exploit-db.com/exploits/46987 · Exploit
• https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20Notes · Aviso do Fabricante
• http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html · Nota
• https://osv.dev/vulnerability/CVE-2019-11080 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11080 · Nota de Segurança