← CVE Radar
CVE-2019-9874Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
9.8 CRITICALEPSS 83.73%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 7.5 | HIGH | 2.0NVD | AV:N/AC:L/Au:N/C:P/I:P/A:P |
CISA required action
⚡ Known exploited · remediation due Apr 16, 2025
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2019-9874
- Status
- Analyzed
- Assigner (CNA)
- mitre
- Published
- May 31, 2019
- Last modified
- 2026-06-17 02:44 UTC
- Weaknesses
Affected Products
From NVD CPE configurations.
sitecorecms1 version range
- 7.0 through 7.2
sitecoreexperience platform1 version range
- 7.5 through 8.2