CVE-2021-42237

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 97,6%

Kerentanan Deserialization of Untrusted Data pada sitecore experience platform. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 25 Maret 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Rincian

Terbit di NVD

5 November 2021

Terakhir diubah

9 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

97,6% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Sitecore XP Remote Command Execution Vulnerability

Masuk KEV

25 Maret 2022

Tenggat CISA

15 April 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42237 pemerintah AS
• http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html advisory pihak ketiga · vdb entry
• https://blog.assetnote.io/2021/11/02/sitecore-rce/ exploit · advisory pihak ketiga