← Back to CVEs
CVE-2019-9874
CRITICALCISA KEV9.8
Description
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
CVE Details
CVSS v3.1 Score9.8
SeverityCRITICAL
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
Published5/31/2019
Last Modified11/7/2025
Sourcekev
Honeypot Sightings0
CISA KEV
VendorSitecore
ProductCMS and Experience Platform (XP)
Vulnerability NameSitecore CMS and Experience Platform (XP) Deserialization Vulnerability
KEV Date Added2025-03-26
Remediation Due Date2025-04-16
Ransomware UseUnknown
Affected Products
sitecore:cmssitecore:experience_platform
Weaknesses (CWE)
CWE-502CWE-502
References
https://dev.sitecore.net/Downloads.aspx(cve@mitre.org)
https://www.synacktiv.com/blog.html(cve@mitre.org)
https://dev.sitecore.net/Downloads.aspx(af854a3a-2127-422b-91ae-364da2661108)
https://www.synacktiv.com/blog.html(af854a3a-2127-422b-91ae-364da2661108)
https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf(af854a3a-2127-422b-91ae-364da2661108)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9874(134c704f-9b21-4f2e-91b3-4a467353bcc0)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.