9.8Crítica
KEV
Usada en ransomware
CVE-2021-42237Sitecore XP Remote Command Execution Vulnerability
Explotación conocida — Sitecore XP Remote Command Execution Vulnerability
CISA confirmó el 25.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 15.04.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2021-42237
Descripción
Sitecore XP 7.5 Initial Release to Sitecore XP 8.2 Update-7 is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.
Debilidad (CWE):
CWE-502
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| sitecore | experience platform | 7.5 |
Referencias y parches
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1000776 Vendor Advisory
- https://blog.assetnote.io/2021/11/02/sitecore-rce/ ExploitThird Party Advisory
- http://packetstormsecurity.com/files/164988/Sitecore-Experience-Platform-XP-Remote-Code-Execution.html Third Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-42237 US Government Resource
Coincidencias CPE (NVD) (24)
cpe:2.3:a:sitecore:experience_platform:7.5:-:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:7.5:update1:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:7.5:update2:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.0:-:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.0:sp1:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.0:update1:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.0:update2:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.0:update3:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.0:update4:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.0:update5:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.0:update6:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.0:update7:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.1:-:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.1:update1:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.1:update2:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.1:update3:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.2:-:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.2:update1:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.2:update2:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.2:update3:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.2:update4:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.2:update5:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.2:update6:*:*:*:*:*:*cpe:2.3:a:sitecore:experience_platform:8.2:update7:*:*:*:*:*:*