Pierluigi Paganini
March 27, 2025
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added [1,2] the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:
CVE-2019-9875 (CVSS score of 8.8) is a
CVE-2019-9874 (CVSS score of 9.8) is a deserialization vulnerability in Sitecore CMS 7.0-7.2 and XP 7.5-8.2 allows unauthenticated attackers to execute code via a malicious __CSRFTOKEN in HTTP POST requests.
CVE-2025-30154 (CVSS score 8.6) is related to the compromise of the GitHub action reviewdog/action-setup@v1 that occurred on March 11, 2025, leaking secrets to workflow logs. Several other reviewdog actions were also affected.
“A supply chain attack on tj-actions/changed-files caused many repositories to leak their secrets over the weekend. Wiz Research has discovered an additional supply chain attack on reviewdog/actions-setup@v1, that may have contributed to the compromise of tj-actions/changed-files.” reported Wiz.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
CISA orders federal agencies to fix the reviewdog action-setup GitHub Action Embedded Malicious Code vulnerability by April 14, 2025 and the Sitecore CMS and Experience Platform (XP) Deserialization flaw by April 16, 2025.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
