VULNERABILITY INTELLIGENCE

CVE-2019-9874

CVSS score9.8 CRITICAL

EPSS probability83.74%

CISA KEVKnown exploited vulnerability

Published2019-05-31

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability

Vendor / product: Sitecore / CMS and Experience Platform (XP)

Description

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

Weakness classification

CWE-502: Deserialization of Untrusted Data

Primary references

cve@mitre.org — Product, Vendor Advisory
cve@mitre.org — Third Party Advisory
cve@mitre.org — Exploit, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource