Every CVESearch/Get API key

CVE-2021-42237

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure...

9.8 CriticalIn KEVPublic exploit

CVE-2021-42237 is a critical vulnerability (CVSS 9.8) in Sitecore Xp, published November 5, 2021. CISA lists it as known to be exploited, since March 25, 2022. EUVD reports exploitation since March 25, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 97.4%, the 99th percentile. No source names a fixed version.

Severity
9.8 CriticalCVSS 3.1, NVD
Exploit chance
97.4%EPSS, 99th percentile
Exploitation
ExploitedCISA KEV,
Fixed in
No fix listedNo source names one

Description

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

97.4%Up 95.6 points since Nov 6, 2021
90%50%10%1%

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitSitecore Experience Platform (XP) PreAuth Deserialization RCE2021-11-02
PoC in GitHubItsIgnacioPortal/CVE-2021-422372022-01-16
PoC in GitHubvesperp/CVE-2021-42237-SiteCore-XP2022-06-30
PoC in GitHubcrankyyash/SiteCore-RCE-Detection2022-09-22
NucleiSitecore Experience Platform Pre-Auth RCE

What each source reports

NVD Score used9.8

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Record
CVE-2021-42237
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-502
Updated
2026-11-02
CVE List9.8

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Record
CVE-2021-42237
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
EUVDEUVD-2021-292159.8

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Record
EUVD-2021-29215
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-j3x5-fr4h-9v7v9.8

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure...

Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Record
GHSA-j3x5-fr4h-9v7v
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-502
Updated
2026-11-02
CISA KEVNo score

Sitecore XP Remote Command Execution Vulnerability

Sitcore XP contains an insecure deserialization vulnerability which can allow for remote code execution.

Record
CVE-2021-42237
Weakness
CWE-502
Updated
2026-11-02

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open