PT-2023-20571 · Sitecore · Sitecore Xp/Xm

Thomas Stern · Publicado 2023-03-14 · Atualizado 2025-02-27 · CVE-2023-26262

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sitecore XP/XM version 10.3

Description An issue exists where an authenticated Sitecore user can upload language files without restrictions, leading to direct code execution on the content management server.

Recommendations For Sitecore XP/XM version 10.3, consider restricting language file uploads to prevent direct code execution until a patch is available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2023-26262

Produtos afetados

Sitecore Xp/Xm

Referências · 8

• 🔥 https://github.com/istern/CVE-2023-26262 · Exploit
• https://t.me/cibsecurity/60031 · Publicação no Telegram
• https://t.me/cvenotify/46531 · Publicação no Telegram
• https://sitecore.com/trust · Aviso do Fabricante
• https://t.me/cvenotify/46169 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-26262 · Nota de Segurança
• https://t.me/cvenotify/112705 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26262 · Aviso do Fabricante