CRITICAL

CVE-2021-42237

Sitecore Experience Platform 2021-11-05 CVSS v3.1

CVSS

9.8

KEV

Description

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Summary dbcve.org

Sitecore XP versions 7.5 Initial Release through 8.2 Update-7 are vulnerable to an insecure deserialization flaw that permits unauthenticated remote command execution on the underlying host, with no special configuration required to exploit it.

Mitigation

Upgrade the Sitecore XP installation to a vendor-patched release beyond 8.2 Update-7 (or apply the corresponding Sitecore security fix for the affected branch), and as a compensating measure restrict network exposure of the Sitecore instance until the patch is deployed.

Proof of Concept

Weakness (CWE)

CWE-502 Deserialization of Untrusted Data

EPSS Score

97.57%

Probability of exploitation in next 30 days

99.9th percentile

References

http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html Third Party Advisory, VDB Entry https://blog.assetnote.io/2021/11/02/sitecore-rce/ Exploit, Third Party Advisory https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776 Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42237 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE