File Upload Vulnerability in Sitecore by Sitecore
CVE-2021-38366

8.8HIGH

Key Information:

Vendor

Sitecore

Status
Sitecore
Vendor
CVE Published:
12 August 2021

What is CVE-2021-38366?

Sitecore versions up to 10.1 with the Update Center enabled are susceptible to a vulnerability that allows authenticated users to upload arbitrary files. This can lead to remote code execution if a malicious user accesses an uploaded .aspx file via the admin/Packages URL, potentially compromising the integrity and security of the affected system.

References

https://blog.istern.dk/2021/08/10/sitecore-10-authenticat...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.