Vulners
Lucene search
Sitecore 8.x Deserialization Remote Code Execution
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | Sitecore 8.x - Deserialization Remote Code Execution Vulnerability | 13 Jun 201900:00 | – | zdt |
 | Sitecore Experience Platform Command Injection Vulnerability | 10 Jun 201900:00 | – | cnvd |
 | CVE-2019-11080 | 6 Jun 201913:33 | – | cve |
 | CVE-2019-11080 | 6 Jun 201913:33 | – | cvelist |
 | Sitecore 8.x - Deserialization Remote Code Execution | 13 Jun 201900:00 | – | exploitdb |
 | Sitecore 8.x - Deserialization Remote Code Execution | 13 Jun 201900:00 | – | exploitpack |
 | CVE-2019-11080 | 6 Jun 201914:29 | – | nvd |
 | Remote code execution | 6 Jun 201914:29 | – | prion |
 | CVE-2019-11080 | 9 Jan 202610:10 | – | redhatcve |
`# Exploit Title: Sitecore v 8.x Deserialization RCE
# Date: Reported to vendor October 2018, fix released April 2019.
# Exploit Author: Jarad Kopf
# Vendor Homepage: https://www.sitecore.com/
# Software Link: Sitecore downloads: https://dev.sitecore.net/Downloads.aspx
# Version: Sitecore 8.0 Revision 150802
# Tested on: Windows
# CVE : CVE-2019-11080
Exploit:
Authentication is needed for this exploit. An attacker needs to login to Sitecore 8.0 revision 150802's Admin section.
When choosing to Serializeusers or domains in the admin UI, calls to /sitecore/shell/~/xaml/Sitecore.Shell.Applications.Dialogs.Progress.aspx will include a CSRFTOKEN parameter.
By replacing this parameter with a URL-encoded, base64-encoded crafted payload from ysoserial.net, an RCE is successful.
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
13 Jun 2019 00:00Current
EPSS0.4053