Description
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.
High · 8.8
Known exploited CVE-2019-9875
EUVD-2019-19231GHSA-7gvq-j6pg-875g
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary cod…
Published May 31, 2019 · Updated Oct 21, 2025 · Assigned by mitre