CVE-2019-12440

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-29 · updated 2026-06-17
Weakness: CWE-287

Description

The Sitecore Rocks plugin before 2.1.149 for Sitecore allows an unauthenticated threat actor to inject malicious commands and code via the Sitecore Rocks Hard Rocks Service.

Affected products

Sitecore Rocks: before 2.1.149 — fixed in 2.1.149

How to fix

Upgrade to a fixed version: Sitecore Rocks 2.1.149. Check the vendor advisory for mitigations.

References

https://github.com/Sitecore/Sitecore.Rocks/compare/be79dcc...bd9ba6a
https://github.com/Sitecore/Sitecore.Rocks/releases/tag/2.1.149
https://kb.sitecore.net/articles/842902
https://github.com/Sitecore/Sitecore.Rocks/compare/be79dcc...bd9ba6a
https://github.com/Sitecore/Sitecore.Rocks/releases/tag/2.1.149
https://kb.sitecore.net/articles/842902

Get alerted when CVE-2019-12440 or the next vulnerability affects your stack