CVE-2019-9875 Sitecore CMS And Experience Platform (XP)
Sitecore CMS and Experience Platform (XP) contain a deserialization vulnerability in the Sitecore.Security.AntiCSRF module that allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.
- CVSS
- not scored
On CISA’s exploited list
Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- Added
- 2025-03-26
- Federal patch deadline
- 2025-04-16
- Ransomware use
- not known