CVE-2021-42237

EUVD-2021-29215
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 99%
Affected Products (NVD)
VendorProductVersion
sitecoreexperience_platform
7.5
sitecoreexperience_platform
7.5:update1
sitecoreexperience_platform
7.5:update2
sitecoreexperience_platform
8.0
sitecoreexperience_platform
8.0:sp1
sitecoreexperience_platform
8.0:update1
sitecoreexperience_platform
8.0:update2
sitecoreexperience_platform
8.0:update3
sitecoreexperience_platform
8.0:update4
sitecoreexperience_platform
8.0:update5
sitecoreexperience_platform
8.0:update6
sitecoreexperience_platform
8.0:update7
sitecoreexperience_platform
8.1
sitecoreexperience_platform
8.1:update1
sitecoreexperience_platform
8.1:update2
sitecoreexperience_platform
8.1:update3
sitecoreexperience_platform
8.2
sitecoreexperience_platform
8.2:update1
sitecoreexperience_platform
8.2:update2
sitecoreexperience_platform
8.2:update3
sitecoreexperience_platform
8.2:update4
sitecoreexperience_platform
8.2:update5
sitecoreexperience_platform
8.2:update6
sitecoreexperience_platform
8.2:update7
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html
http://sitecore.com
https://blog.assetnote.io/2021/11/02/sitecore-rce/
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776
http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html
http://sitecore.com
https://blog.assetnote.io/2021/11/02/sitecore-rce/
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42237