CVE-2019-9874Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Explotación conocida — Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
CISA confirmó el 26.03.2025 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 16.04.2025.
Acción requerida: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB0334035 ; https://nvd.nist.gov/vuln/detail/CVE-2019-9874
Descripción
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| sitecore | cms | 7.0 – ≤ 7.2 | |
| sitecore | experience platform | 7.5 – ≤ 8.2 |
Referencias y parches
- https://dev.sitecore.net/Downloads.aspx ProductVendor Advisory
- https://www.synacktiv.com/blog.html Third Party Advisory
- https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf ExploitPatchThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9874 US Government Resource
Coincidencias CPE (NVD) (2)
cpe:2.3:a:sitecore:cms:*:*:*:*:*:*:*:*≥ 7.0 ≤ 7.2cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*≥ 7.5 ≤ 8.2