CVE-2021-42237: Sitecore XP Remote Command Execution Vulnerability
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
Other sources
Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-42237?
CVE-2021-42237 is a vulnerability in Sitecore XP that allows for remote command execution on the machine.
How severe is CVE-2021-42237?
The severity of CVE-2021-42237 is critical with a CVSS score of 9.8.
Which versions of Sitecore Experience Platform are affected by CVE-2021-42237?
Sitecore XP versions 7.5 to 8.2 Update-7 are affected by CVE-2021-42237.
Is authentication or special configuration required to exploit CVE-2021-42237?
No, no authentication or special configuration is required to exploit CVE-2021-42237.
How can CVE-2021-42237 be fixed?
To fix CVE-2021-42237, it is recommended to apply the relevant security patches or updates provided by Sitecore.