{"id":"CVE-2019-9875","kind":"vulnerability","aliases":["CVE-2019-9875"],"related":[],"title":"sitecore cms: Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker…","description":"Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"Sitecore CMS and Experience Platform (XP) has a .NET deserialization flaw in the Sitecore.Security.AntiCSRF module. An attacker who can log in can send a crafted serialized object in the __CSRFTOKEN POST parameter and run arbitrary code on the server.","severity":"critical","cvss":8.8,"epss":null,"exploited":true,"exploited_at":"2025-03-26T00:00:00+00:00","products":[{"name":"Sitecore CMS and Experience Platform (XP)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"sitecore cms","fixed":[],"affected":"<= 9.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dotnet","exploited","self-hosted","sitecore","vendor"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":null,"fix":"Apply the mitigations from the Sitecore vendor advisory, or discontinue use of the product if mitigations are unavailable (per CISA required action).","status":"open","published_at":"2019-05-31T21:29:06+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:48:54+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T20:48:54Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from the Sitecore vendor advisory, or discontinue use of the product if mitigations are unavailable (per CISA required action).\nunknown","reach":"internet","summary":"Sitecore CMS and Experience Platform (XP) has a .NET deserialization flaw in the Sitecore.Security.AntiCSRF module. An attacker who can log in can send a crafted serialized object in the __CSRFTOKEN POST parameter and run arbitrary code on the server.","category":"vendor","who_cares":["sitecore","self-hosted","dotnet"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the Sitecore server after logging in.","analyst_note":"Find the Sitecore vendor advisory and the list of affected and fixed versions; the sources here give no version or check steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000451,"input_tokens":2609,"output_tokens":380,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':127C '-2019':21A,24A '-9875':22A,25A '22':126C '9.1':15A 'action':117C 'allow':16A,95C 'and':28A 'anti':9A 'appli':118C 'applic':124C 'arbitrari':75B,101C 'attack':19A,57B,98C 'authent':18A,97C 'bod':125C 'cisa':115C 'cloud':130C 'cms':2A,27A,33A,42B,81C 'code':76B,102C 'contain':86C 'craft':65B 'csrf':10A 'csrftoken':70B,114C 'cve':20A,23A 'data':6A 'deseri':3A,50B,88C 'discontinu':133C 'dotnet':34B 'execut':100C 'experi':44B,83C 'experience':29A 'exploit':35B 'flaw':51B 'follow':123C 'guidanc':128C 'host':38B 'http':111C 'instruct':122C 'log':60B 'mitig':119C,139C 'modul':11A,55B,93C 'net':49B,107C 'object':67B,108C 'paramet':72B,113C 'per':120C 'platform':30A,45B,84C 'post':71B,112C 'product':137C 'requir':116C 'run':74B 'self':37B 'self-host':36B 'send':63B,104C 'serial':66B,106C 'server':79B 'servic':131C 'sitecor':1A,13A,39B,41B,80C 'sitecore':26A,32A 'sitecore.security.anticsrf':54B,92C 'unavail':141C 'untrust':5A 'use':134C 'vendor':40B,121C 'vulner':89C 'xp':31A,46B,85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-05-31T21:29:06+00:00","kev":{"dateAdded":"2025-03-26","dueDate":"2025-04-16","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2019-9875","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-9875","severity":null,"published_at":"2025-03-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2019-9875","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9875","severity":null,"published_at":"2019-05-31T21:29:06+00:00","modified_at":"2026-06-17T02:44:46+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}