CMS vulnerabilities

2 known vulnerabilities in CMS from Sitecore. 2 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Sitecore CMS and Experience Platform (XP) Deserialization Exploited

  CVE-2019-9875May 31, 2019SitecoreEPSS 25.4%

  Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.

• 9.8 Critical severity

  Sitecore CMS and Experience Platform (XP) Deserialization Exploited

  CVE-2019-9874May 31, 2019SitecoreEPSS 83.7%

  Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST p