PT-2019-12168 · Sitecore · Sitecore Experience Platform

Jarad Kopf · Published 2019-06-06 · Updated 2019-06-13 · CVE-2019-11080

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Sitecore Experience Platform (XP) versions prior to 9.1.1

Description The issue allows remote code execution via deserialization. An authenticated user with necessary permissions can remotely execute OS commands by sending a crafted serialized object.

Recommendations For versions prior to 9.1.1, update to version 9.1.1 or later to resolve the issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2019-11080

Affected Products

Sitecore Experience Platform

References · 6

• 🔥 https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE · Exploit
• 🔥 https://exploit-db.com/exploits/46987 · Exploit
• https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20Notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-11080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11080 · Security Note
• http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html · Note