PT-2019-19909 · Sitecore · Sitecore

CVE-2019-9875 · Publicado 2019-05-31 · Atualizado 2025-04-04

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sitecore versions prior to 9.1

Description The issue allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter due to deserialization of untrusted data in the anti CSRF module.

Recommendations For versions prior to 9.1, update to version 9.1 or later to resolve the issue.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2019-9875

Produtos afetados

Sitecore

Referências · 15

• 🔥 https://synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf · Exploit
• https://synacktiv.com/blog.html · Nota
• https://twitter.com/DeepFlowcc/status/1905175510868693328 · Publicação no Twitter
• https://t.me/cvenotify/116395 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-9875 · Nota de Segurança
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9875 · Nota
• https://t.me/pentestingnews/58576 · Publicação no Telegram
• https://twitter.com/syedaquib77/status/1905635456706117863 · Publicação no Twitter
• https://dev.sitecore.net/Downloads.aspx · Aviso do Fabricante
• https://t.me/cvenotify/116443 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2019-9875 · Aviso do Fabricante
• https://reddit.com/r/pwnhub/comments/1jl99qb/critical_sitecore_vulnerabilities_under_active · Publicação no Reddit
• https://reddit.com/r/pwnhub/comments/1jl95cc/cisa_identifies_sitecore_rce_vulnerabilities · Publicação no Reddit
• https://t.me/cvenotify/117795 · Publicação no Telegram
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556 · Nota de Segurança