Detections
Analytics

CVE-2019-12440

critical

Description

The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service.

References

https://github.com/Sitecore/Sitecore.Rocks/releases/tag/2.1.149

https://github.com/Sitecore/Sitecore.Rocks/compare/be79dcc...bd9ba6a

https://kb.sitecore.net/articles/842902

Details

Source: Mitre, NVD

Published: 2019-05-29

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.00674