CVE-2019-9875
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CVSS
—
Sem CVSS
EPSS
25.4%
p98
KEV
SIM
26 de mar. de 2025
Exploit Today
79
0-100
Publicado: — · Última mod.: —
Produto
Sitecore / CMS and Experience Platform (XP)
Vulnerabilidade
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Adicionado ao KEV
26 de mar. de 2025
Corrigir até
16 de abr. de 2025
Uso conhecido em ransomware
Não
Descrição resumida
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Ação necessária
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notas
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0038556 ; https://nvd.nist.gov/vuln/detail/CVE-2019-9875