CVE-2021-42237criticalunder attackransomwareCWE-502

CVE-2021-42237

Published · Updated

Follow this CVE+ Monitor XP

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 97%
from disclosure to weapon72 days
Published on NVDNov 5
1st PoC+72d
metasploitNov 2
CISA KEV+140d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Sitecore XP versions 7.5 through 8.2 Update-7 have a critical flaw that allows attackers to run commands on the server without logging in. The vulnerability is in how the software handles data deserialization, which can be exploited by sending specially crafted requests over the network.

Technical detail

The vulnerability exists in Sitecore XP's insecure deserialization mechanism (CWE-502), allowing unauthenticated remote attackers to execute arbitrary code on the affected server. The attack vector is network-based with no pre-conditions or authentication required; successful exploitation results in complete remote code execution with server privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.