CVE-2019-9874: Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter CSRFTOKEN.
Other sources
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter CSRFTOKEN.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Sitecore CMS and Experience Platform (XP)from your environment.Discontinue use of the product if mitigations are unavailable.
- Compensating control
Follow applicable BOD 22-01 guidance for cloud services to mitigate risk to hosted Sitecore deployments.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-9874?
CVE-2019-9874 is classified as critical due to its potential for arbitrary code execution.
How do I fix CVE-2019-9874?
To remediate CVE-2019-9874, upgrade to a fixed version of Sitecore CMS or Sitecore XP that is not affected by this vulnerability.
Who is affected by CVE-2019-9874?
CVE-2019-9874 affects users of Sitecore CMS versions 7.0 to 7.2 and Sitecore XP versions 7.5 to 8.2.
What types of attacks can CVE-2019-9874 enable?
CVE-2019-9874 can allow unauthenticated attackers to execute arbitrary code on vulnerable systems.
Is CVE-2019-9874 easy to exploit?
Yes, CVE-2019-9874 can be easily exploited by sending a specially crafted HTTP POST request.