CVE-2021-38366

HIGH

Sitecore < 10.1 - Authenticated Remote Code Execution via Update Center File Upload

Title source: llm
STIX 2.1

Description

Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0293
EPSS Percentile 85.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
sitecore/sitecore < 10.1
Published Aug 12, 2021
Tracked Since Feb 18, 2026