PT-2019-19908 · Sitecore · Sitecore Xp+2
CVE-2019-9874
·
Publicado
2019-02-19
·
Atualizado
2025-11-07
CVSS v3.1
10
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Sitecore CMS versions 7.0 through 7.2
Sitecore XP versions 7.5 through 8.2
Description
The issue allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter
CSRFTOKEN. This is due to the deserialization of untrusted data in the Sitecore.Security.AntiCSRF module.Recommendations
For Sitecore CMS versions 7.0 through 7.2, update to a version that fixes the deserialization of untrusted data issue.
For Sitecore XP versions 7.5 through 8.2, update to a version that fixes the deserialization of untrusted data issue.
As a temporary workaround, consider restricting access to the
CSRFTOKEN parameter in the HTTP POST request to minimize the risk of exploitation.Exploit
Correção
Deserialization of Untrusted Data
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sitecore Cms
Sitecore Xp
Sitecore.Security.Anticsrf