The article says only Initial Release of 8.2 is affected but doesn't say Update 1 is not vulnerable.

1 Answer 1


Update 1 has that security issue fixed by default.

In Sitecore 8.2 Update 1, a list of allowed serializable types is included out of the box. You can find the list in the configuration file Sitecore.Analytics.SessionSerialization.config.

Note that the security patch SC2016-001-128003 had the allowed types configured in the configuration file Sitecore.SessionSerialization.config instead (without the Analytics suffix). So if you upgrade your instance to 8.2 Update 1 from an earlier version with the patch applied, you will need to make sure the following files are removed from your solution:

  • \App_Config\Include\Sitecore.SessionSerialization.config
  • \bin\Sitecore.SessionSerialization.dll

As well as that the following file is updated with the 8.2u1 version:

  • \sitecore\service\Analytics\Session\PushSession.ashx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.