U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Sitecore CMS and XP, and GitHub Action flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added [1,2] the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:
- CVE-2019-9875 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- CVE-2019-9874 Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability
- CVE-2025-30154 reviewdog action-setup GitHub Action Embedded Malicious Code Vulnerability
CVE-2019-9875 (CVSS score of 8.8) is a Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 the allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.
CVE-2019-9874 (CVSS score of 9.8) is a deserialization vulnerability in Sitecore CMS 7.0-7.2 and XP 7.5-8.2 allows unauthenticated attackers to execute code via a malicious __CSRFTOKEN in HTTP POST requests.
CVE-2025-30154 (CVSS score 8.6) is related to the compromise of the GitHub action reviewdog/action-setup@v1 that occurred on March 11, 2025, leaking secrets to workflow logs. Several other reviewdog actions were also affected.
“A supply chain attack on tj-actions/changed-files caused many repositories to leak their secrets over the weekend. Wiz Research has discovered an additional supply chain attack on reviewdog/actions-setup@v1, that may have contributed to the compromise of tj-actions/changed-files.” reported Wiz.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix the reviewdog action-setup GitHub Action Embedded Malicious Code vulnerability by April 14, 2025 and the Sitecore CMS and Experience Platform (XP) Deserialization flaw by April 16, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
