Paper/Archive/CVE-2019-9874

CVE-2019-9874

Sitecore CMS and Experience Platform (XP) — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

KEV · due 16 Apr EPSS 84%public exploit SSVC act CVSS 9.8

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 99.7.997 × 2019.9 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refdev.sitecore.net/Downloads.aspx refsynacktiv.com/blog.html refsynacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9874 kevcisa.gov/known-exploited-vulnerabilities-catalog