Evil-DB LogoEvil-DB
← All CVEs

CVE-2021-42237

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2022-03-25Remediation due 2022-04-15

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

9.8
CVSS
97.9%
EPSS (exploit prob.)
100th
EPSS percentile
2021-11-05
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-502

Affected products

VendorProductAffected versions
sitecoreexperience_platform7.5
sitecoreexperience_platform7.5
sitecoreexperience_platform7.5
sitecoreexperience_platform8.0
sitecoreexperience_platform8.0
sitecoreexperience_platform8.0
sitecoreexperience_platform8.0
sitecoreexperience_platform8.0
sitecoreexperience_platform8.0
sitecoreexperience_platform8.0
sitecoreexperience_platform8.0
sitecoreexperience_platform8.0
sitecoreexperience_platform8.1
sitecoreexperience_platform8.1
sitecoreexperience_platform8.1
sitecoreexperience_platform8.1
sitecoreexperience_platform8.2
sitecoreexperience_platform8.2
sitecoreexperience_platform8.2
sitecoreexperience_platform8.2
sitecoreexperience_platform8.2
sitecoreexperience_platform8.2
sitecoreexperience_platform8.2
sitecoreexperience_platform8.2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-42237