CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1–1 of 1 advisories (Page 1/1)
2019-05-31
Sitecore CMS and XP AntiCSRF Module Deserialization Remote Code Execution (RCE) (CVE-2019-9874)
[Affected Scope] Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a malicious serialized .NET object in the __CSRFTOKEN HTTP POST parameter
[Mitigation] Apply official security patches, disable the vulnerable AntiCSRF module, or upgrade to a supported secure version