Threat intelligence / Vulnerability
CVE-2019-9874
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Vulnerability
TypeVulnerability
External ID—
First seen2025-03-26
Last seen2025-03-26
Confidence
—
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
Labels
CISA KEV context
Vendor / productSitecore CMS and Experience Platform (XP)
Added2025-03-26
Due date2025-04-16
2 recorded
Relationships
2 external