SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2021-42237

Sitecore XP Remote Command Execution Vulnerability

KEVCRITICAL 9.8EPSS 97.9%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 15 April 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
97.90% probability · 100th percentile
CISA KEV
Listed 25 March 2022 · due 15 April 2022 · used in ransomware campaigns
Weakness
CWE-502
Affected
sitecore/experience platform
Source
cve@mitre.org

CISA notes

Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2021-42237

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.