PT-2019-19909 · Sitecore · Sitecore

Published 2019-05-31 · Updated 2025-04-04 · CVE-2019-9875

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sitecore versions prior to 9.1

Description The issue allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter due to deserialization of untrusted data in the anti CSRF module.

Recommendations For versions prior to 9.1, update to version 9.1 or later to resolve the issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2019-9875

Affected Products

Sitecore

References · 15

• 🔥 https://synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9875 · Security Note
• https://dev.sitecore.net/Downloads.aspx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9875 · Vendor Advisory
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556 · Security Note
• https://synacktiv.com/blog.html · Note
• https://twitter.com/DeepFlowcc/status/1905175510868693328 · Twitter Post
• https://t.me/cvenotify/116395 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9875 · Note
• https://t.me/pentestingnews/58576 · Telegram Post
• https://twitter.com/syedaquib77/status/1905635456706117863 · Twitter Post
• https://t.me/cvenotify/116443 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1jl99qb/critical_sitecore_vulnerabilities_under_active · Reddit Post
• https://reddit.com/r/pwnhub/comments/1jl95cc/cisa_identifies_sitecore_rce_vulnerabilities · Reddit Post
• https://t.me/cvenotify/117795 · Telegram Post