PT-2023-24432 · Sitecore · Sitecore Experience Commerce+2

Dylan Pindur · Publicado 2023-06-06 · Atualizado 2025-01-08 · CVE-2023-33651

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sitecore Experience Platform (XP) versions 9.0 Initial Release through 13.0 Initial Release Sitecore Experience Manager (XM) versions 9.0 Initial Release through 13.0 Initial Release Sitecore Experience Commerce (XC) versions 9.0 Initial Release through 13.0 Initial Release

Description An issue in the MVC Device Simulator allows attackers to bypass authorization rules.

Recommendations For Sitecore Experience Platform (XP) versions 9.0 Initial Release through 13.0 Initial Release, update to a version that includes a fix for this issue. For Sitecore Experience Manager (XM) versions 9.0 Initial Release through 13.0 Initial Release, update to a version that includes a fix for this issue. For Sitecore Experience Commerce (XC) versions 9.0 Initial Release through 13.0 Initial Release, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the MVC Device Simulator until a patch is available.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-33651

Produtos afetados

Sitecore Experience Commerce

Sitecore Experience Manager

Sitecore Experience Platform

Referências · 5

• 🔥 https://blog.assetnote.io/2023/05/10/sitecore-round-two · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-33651 · Nota de Segurança
• https://t.me/cibsecurity/65015 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33651 · Aviso do Fabricante
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925 · Aviso do Fabricante