CVE-2019-12440

EUVD-2019-4049
The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 71%
Affected Products (NVD)
VendorProductVersion
sitecorerocks
𝑥
< 2.1.149
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/Sitecore/Sitecore.Rocks/compare/be79dcc...bd9ba6a
https://github.com/Sitecore/Sitecore.Rocks/releases/tag/2.1.149
https://kb.sitecore.net/articles/842902
https://github.com/Sitecore/Sitecore.Rocks/compare/be79dcc...bd9ba6a
https://github.com/Sitecore/Sitecore.Rocks/releases/tag/2.1.149
https://kb.sitecore.net/articles/842902