CyberSec.Space Logo
Back to CVE Browser

CVE-2019-11080

HIGH
8.8
CVSS Severity Score
EPSS Score0.1140%
EPSS Percentile1.29th
PublishedJun 6, 2019
Last ModifiedNov 21, 2024

Vulnerability Description

Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.

Affected Platforms (CPE)

📦
Sitecore

Experience Platform

< 9.1.1

References & Advisories

🔗 http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html
🔗 https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20Notes
🔗 https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE
🔗 http://packetstormsecurity.com/files/153274/Sitecore-8.x-Deserialization-Remote-Code-Execution.html
🔗 https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/91/Sitecore%20Experience%20Platform%2091%20Update1/Release%20Notes
🔗 https://github.com/minecrater/exploits/blob/master/Sitecore8xDeserialRCE

Related Vulnerabilities

CVE-2021-279319.1

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp...

CVE-2016-06358.8

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2,...

CVE-2021-319288.8

Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to escalate privileges to superadministrator...

CVE-2021-02518.6

A NULL Pointer Dereference vulnerability in the Captive Portal Content Delivery (CPCD) services daemon (cpcd) of Juniper Networks ...