CVE-2019-12440

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/Sitecore/Sitecore.Rocks/compare/be79dcc...bd9ba6aPatch, Third Party Advisory
https://github.com/Sitecore/Sitecore.Rocks/releases/tag/2.1.149Release Notes, Third Party Advisory
https://kb.sitecore.net/articles/842902Patch, Vendor Advisory
https://github.com/Sitecore/Sitecore.Rocks/compare/be79dcc...bd9ba6aPatch, Third Party Advisory
https://github.com/Sitecore/Sitecore.Rocks/releases/tag/2.1.149Release Notes, Third Party Advisory
https://kb.sitecore.net/articles/842902Patch, Vendor Advisory

Timeline

Published: May 29, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-124417.5An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. The protected branches feature contained a access cont CVE-2019-124426.1An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and outp CVE-2019-124439.8An issue was discovered in GitLab Community and Enterprise Edition 10.2 through 11.11. Multiple features contained Server-Side Request Forge CVE-2019-124446.1An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which CVE-2019-124455.4An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on note CVE-2019-124467.5An issue was discovered in GitLab Community and Enterprise Edition 8.3 through 11.11. It allows Information Exposure through an Error Messag CVE-2019-124477.3An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not use CVE-2019-124488.1An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't CVE-2019-124495.7An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during m CVE-2019-12456.5An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Informatio CVE-2019-124509.8file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is CVE-2019-124527.5types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without