Threat Investigation
Request a demo

CVE-2019-12440

Critical

Description

The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service.

SeverityCritical
CVSS9.8
Exploit probability—
ProductSitecore Rocks
PublishedMay 29, 2019
First seenMay 29, 2019

How to fix

Update
  • sitecore rocks2.1.149 or later

Affected products

ProductAffected versionsFixed in
sitecore rocksv < 2.1.1492.1.149

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.