Back to CVE Browser

CVE-2019-9875

Known Exploited (CISA KEV)HIGH

8.8

CVSS Severity Score

EPSS Score67.6290%

EPSS Percentile93.50th

PublishedMay 31, 2019

Last ModifiedNov 7, 2025

Vulnerability Description

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.

Affected Platforms (CPE)

📦

Sitecore

Cms

<= 9.1

References & Advisories

🔗 https://dev.sitecore.net/Downloads.aspx

🔗 https://www.synacktiv.com/blog.html

🔗 https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf

🔗 https://dev.sitecore.net/Downloads.aspx

🔗 https://www.synacktiv.com/blog.html

🔗 https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9875

Related Vulnerabilities

CVE-2005-400710.0

Multiple unspecified vulnerabilities in SAPID CMS before 1.2.3.03, related to newly registered users and possibly authorization ch...

CVE-2005-376410.0

The image gallery (imagegallery) component in Exponent CMS 0.96.3 and later versions does not properly check the MIME type of uplo...

CVE-2020-1518810.0

SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute a...

CVE-2006-160410.0

Unspecified vulnerability in Exponent CMS before 0.96.5 RC 1 has unknown impact and remote attack vectors related to variables tha...