CVEブラウザに戻る

CVE-2019-9875

Known Exploited (CISA KEV)HIGH

8.8

CVSS Severity Score

EPSS Score67.6290%

EPSS Percentile93.50th

Published2019年5月31日

Last Modified2025年11月7日

Vulnerability Description

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.

Affected Platforms (CPE)

📦

Sitecore

Cms

<= 9.1

References & Advisories

🔗 https://dev.sitecore.net/Downloads.aspx

🔗 https://www.synacktiv.com/blog.html

🔗 https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf

🔗 https://dev.sitecore.net/Downloads.aspx

🔗 https://www.synacktiv.com/blog.html

🔗 https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9875

関連する脆弱性情報

CVE-2005-400710.0

Multiple unspecified vulnerabilities in SAPID CMS before 1.2.3.03, related to newly registered users and possibly authorization ch...

CVE-2005-376410.0

The image gallery (imagegallery) component in Exponent CMS 0.96.3 and later versions does not properly check the MIME type of uplo...

CVE-2020-1518810.0

SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute a...

CVE-2006-160410.0

Unspecified vulnerability in Exponent CMS before 0.96.5 RC 1 has unknown impact and remote attack vectors related to variables tha...