CVE-2019-9874

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://dev.sitecore.net/Downloads.aspxProduct, Vendor Advisory
https://www.synacktiv.com/blog.htmlThird Party Advisory
https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdfExploit, Patch, Third Party Advisory
https://dev.sitecore.net/Downloads.aspxProduct, Vendor Advisory
https://www.synacktiv.com/blog.htmlThird Party Advisory
https://www.synacktiv.com/ressources/advisories/Sitecore_CSRF_deserialize_RCE.pdfExploit, Patch, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9874US Government Resource

Timeline

Published: May 31, 2019
Last modified: Jun 17, 2026
Added to CISA KEV: Mar 26, 2025
NVD status: Analyzed

Related CVEs from 2019

CVE-2019-98758.8Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code CVE-2019-98777.8There is an invalid memory access vulnerability in the function TextPage::findGaps() located at TextOutputDev.c in Xpdf 4.01, which can (for CVE-2019-98787.8There is an invalid memory access in the function GfxIndexedColorSpace::mapColorToBase() located in GfxState.cc in Xpdf 4.0.0, as used in pd CVE-2019-98799.8The WPGraphQL 0.2.3 plugin for WordPress allows remote attackers to register a new user with admin privileges, whenever new user registratio CVE-2019-98809.1An issue was discovered in the WPGraphQL 0.2.3 plugin for WordPress. By querying the 'users' RootQuery, it is possible, for an unauthenticat CVE-2019-98815.3The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even wh CVE-2019-98828.8Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to add malicious email sources into whitelist CVE-2019-98838.8Multi modules of MailSherlock MSR35 and MSR45 lead to a CSRF vulnerability. It allows attacker to elevate privilege of specific account via CVE-2019-98849.8eClass platform < ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access ma CVE-2019-98859.8eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter.CVE-2019-98867.5Any URLs with download_attachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eC CVE-2019-98892.7In Vanilla before 2.6.4, a flaw exists within the getSingleIndex function of the AddonManager class. The issue results in a require call usi