ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2021-38366

PoC —
CVSS 3.1
8.8 high
EPSS
3%p86
Published
()
Modified
Description

Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL.

Vendors
sitecore
Products
sitecore
Weakness
CWE-434
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (2.9%)

In the news

No ingested article mentions this CVE yet.