EXPOSURES › CVE-2019-9874

CVE-2019-9874

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2025-03-26 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2019-9874 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 65/100 rceexploited-in-wild

Sitecore CMS allowed unauthenticated code execution via a deserialization vulnerability in its anti-CSRF module.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

sitecore · vendor CMS and Experience Platform (XP) · product

DESCRIPTION

Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.