PT-2019-19908 · Sitecore · Sitecore Xp+2

Published

2019-02-19

·

Updated

2025-11-07

·

CVE-2019-9874

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Sitecore CMS versions 7.0 through 7.2 Sitecore XP versions 7.5 through 8.2
Description The issue allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter CSRFTOKEN. This is due to the deserialization of untrusted data in the Sitecore.Security.AntiCSRF module.
Recommendations For Sitecore CMS versions 7.0 through 7.2, update to a version that fixes the deserialization of untrusted data issue. For Sitecore XP versions 7.5 through 8.2, update to a version that fixes the deserialization of untrusted data issue. As a temporary workaround, consider restricting access to the CSRFTOKEN parameter in the HTTP POST request to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-14503
CVE-2019-9874

Affected Products

Sitecore Cms
Sitecore Xp
Sitecore.Security.Anticsrf