CVE-2019-11080: Critical severity sitecore vulnerability

Q: What is the vulnerability ID?

The vulnerability ID is CVE-2019-11080.

Q: What is the title of the vulnerability?

The title of the vulnerability is 'Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization.'

Q: What is the severity of CVE-2019-11080?

The severity of CVE-2019-11080 is critical with a severity value of 8.8.

Q: How does the vulnerability occur?

The vulnerability occurs when an authenticated user with necessary permissions sends a crafted serialized object, allowing remote execution of OS commands.

Q: How can I fix CVE-2019-11080?

To fix CVE-2019-11080, it is recommended to upgrade Sitecore Experience Platform (XP) to version 9.1.1 or later.

Published Jun 6, 2019

Updated

Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.

Affected Software

1 affected component

Sitecore Experience Platform<9.1.1

Event History

Jun 6, 2019

CVE Published

via MITRE·01:33 PM

Data Sourced

via MITRE·01:33 PM

Description

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2019-11080.

What is the title of the vulnerability?

The title of the vulnerability is 'Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization.'

What is the severity of CVE-2019-11080?

The severity of CVE-2019-11080 is critical with a severity value of 8.8.

How does the vulnerability occur?

The vulnerability occurs when an authenticated user with necessary permissions sends a crafted serialized object, allowing remote execution of OS commands.

How can I fix CVE-2019-11080?