CVE-2019-9875

What is Sitecore Experience Platform?

Sitecore CMS and Experience Platform (XP) is an enterprise .NET-based content management and digital marketing platform used by large organizations to run public-facing websites, personalized marketing campaigns, and customer experience portals.

Overview

CVE-2019-9875 is the low-privileged counterpart to CVE-2019-9874: a high-severity (CVSS 8.8) .NET deserialization vulnerability in the same Sitecore.Security.AntiCSRF module. It requires low-privileged authentication rather than none, but otherwise follows the same exploitation pattern — a malicious serialized .NET object submitted via the __CSRFTOKEN POST parameter leads to remote code execution.

Affected Versions

Technical Details

Like CVE-2019-9874, the AntiCSRF module deserializes attacker-supplied data from the __CSRFTOKEN POST field using unsafe .NET deserialization without validating the payload's object type (CWE-502). Here, however, the vulnerable code path requires the requester to hold at least low-level authenticated access before the malicious object is deserialized, which is why this variant scores slightly lower than its unauthenticated sibling despite otherwise identical impact.

Discovery

Sitecore published fix guidance in knowledge-base article KB0038556, addressing this low-privileged variant of the AntiCSRF deserialization issue.

Exploitation Context

Like CVE-2019-9874, this CVE saw renewed confirmed exploitation years after its original 2019 disclosure, prompting CISA to add it to the KEV catalog in March 2025. Legacy Sitecore deployments that retained even low-privilege user accounts — such as basic content-author logins — remained exploitable through this path, illustrating why authenticated-only vulnerabilities in widely deployed CMS platforms still carry serious real-world risk.

Remediation

1. Apply Sitecore's patch referenced in KB0038556 (or upgrade to a current, supported Sitecore XP release) without delay.
2. Audit and minimize the number of low-privileged accounts (including content-author and service accounts) that could be leveraged to trigger this flaw.
3. Restrict direct internet access to Sitecore's authenticated endpoints where feasible.
4. Monitor for unusual authenticated POST requests containing large or unusual __CSRFTOKEN values.
5. Treat this as a companion fix to CVE-2019-9874 — patching one without the other leaves the platform exposed.