CVE-2019-9875

Опубликовано: 31 мая 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Средний

Описание

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.

Ссылки

https://dev.sitecore.net/Downloads.aspx
Product
Vendor Advisory
https://www.synacktiv.com/blog.html
Third Party Advisory
https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf
Exploit
Patch
Third Party Advisory
https://dev.sitecore.net/Downloads.aspx
Product
Vendor Advisory
https://www.synacktiv.com/blog.html
Third Party Advisory
https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdf
Exploit
Patch
Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9875
US Government Resource

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sitecore:cms:*:*:*:*:*:*:*:*

Версия до 9.1 (включая)

EPSS

Процентиль: 96%

0.24766

Средний

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-502

Связанные уязвимости

GHSA-7gvq-j6pg-875g