CVEvulnerability

CVE-2021-42237

9.8 CRITICAL Known exploited Published 2021-11-05 Modified 2026-07-09 Official page ↗

CISA Known Exploited Vulnerability

Sitecore XP Remote Command Execution Vulnerability — Sitecore XP

Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.

Added to KEV
2022-03-25
Remediation due
2022-04-15
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2021-42237
Status
Analyzed
Published
2021-11-05
Last modified
2026-07-09
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-502

Description

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Affected configurations

• sitecore experience platform 7.5 • sitecore experience platform 8.0 • sitecore experience platform 8.1 • sitecore experience platform 8.2

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References