VULNERABILITY INTELLIGENCE

CVE-2021-38366

CVSS score8.8 HIGH
EPSS probability2.93%
CISA KEVNot currently listed
Published2021-08-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Sitecore through 10.1, when Update Center is enabled, allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL.

Weakness classification

  • CWE-434: Unrestricted Upload of File with Dangerous Type

Primary references