CyberSec.Space Logo
Back to CVE Browser

CVE-2021-42237

Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score58.7780%
EPSS Percentile88.26th
PublishedNov 5, 2021
Last ModifiedNov 10, 2025

Vulnerability Description

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Affected Platforms (CPE)

📦
Sitecore

Experience Platform

= 7.5
📦
Sitecore

Experience Platform

= 7.5
📦
Sitecore

Experience Platform

= 7.5
📦
Sitecore

Experience Platform

= 8.0
📦
Sitecore

Experience Platform

= 8.0
📦
Sitecore

Experience Platform

= 8.0
📦
Sitecore

Experience Platform

= 8.0
📦
Sitecore

Experience Platform

= 8.0
📦
Sitecore

Experience Platform

= 8.0
📦
Sitecore

Experience Platform

= 8.0
📦
Sitecore

Experience Platform

= 8.0
📦
Sitecore

Experience Platform

= 8.0
📦
Sitecore

Experience Platform

= 8.1
📦
Sitecore

Experience Platform

= 8.1
📦
Sitecore

Experience Platform

= 8.1
📦
Sitecore

Experience Platform

= 8.1
📦
Sitecore

Experience Platform

= 8.2
📦
Sitecore

Experience Platform

= 8.2
📦
Sitecore

Experience Platform

= 8.2
📦
Sitecore

Experience Platform

= 8.2
📦
Sitecore

Experience Platform

= 8.2
📦
Sitecore

Experience Platform

= 8.2
📦
Sitecore

Experience Platform

= 8.2
📦
Sitecore

Experience Platform

= 8.2

References & Advisories

🔗 http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html
🔗 http://sitecore.com
🔗 https://blog.assetnote.io/2021/11/02/sitecore-rce/
🔗 https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776
🔗 http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html
🔗 http://sitecore.com
🔗 https://blog.assetnote.io/2021/11/02/sitecore-rce/
🔗 https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776

Related Vulnerabilities

CVE-2021-279319.1

LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp...

CVE-2021-319288.8

Annex Cloud Loyalty Experience Platform <2021.1.0.1 allows any authenticated attacker to escalate privileges to superadministrator...

CVE-2019-110808.8

Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization, aka TFS # 293863. An ...

CVE-2016-06358.8

Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.4, 12.2.2,...