Sitecore XP 7.5 <= 7.5.2 / 8.0 <= 8.0.7 / 8.1 <= 8.1.3 / 8.2 <= 8.2.7 RCE

critical Nessus Plugin ID 159522

Language:

Synopsis

The remote web server contains an application that is affected by a remote command execution vulnerability.

Description

The remote host is running a version of Sitecore XP that is vulnerable to an insecure deserialization attack where it is possible to achieve remote command execution on the machine. No authentication or special configuration is required to exploit this vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

See vendor advisory.

Plugin Details

Severity: Critical

ID: 159522

File Name: sitecore_xp_SC2021-003-499266.nasl

Version: 1.2

Type: remote

Family: CGI abuses

Published: 4/5/2022

Updated: 6/1/2022

Configuration: Enable paranoid mode, Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2021-42237

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:sitecore:experience_platform

Required KB Items: Settings/ParanoidReport, www/sitecore_cms, installed_sw/sitecore_cms

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 10/8/2021

Vulnerability Publication Date: 10/8/2021

Detections

Analytics