PT-2023-20571 · Sitecore · Sitecore Xp/Xm

Thomas Stern · Published 2023-03-14 · Updated 2025-02-27 · CVE-2023-26262

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sitecore XP/XM version 10.3

Description An issue exists where an authenticated Sitecore user can upload language files without restrictions, leading to direct code execution on the content management server.

Recommendations For Sitecore XP/XM version 10.3, consider restricting language file uploads to prevent direct code execution until a patch is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-26262

Affected Products

Sitecore Xp/Xm

References · 8

• 🔥 https://github.com/istern/CVE-2023-26262 · Exploit
• https://sitecore.com/trust · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-26262 · Security Note
• https://osv.dev/vulnerability/CVE-2023-26262 · Vendor Advisory
• https://t.me/cibsecurity/60031 · Telegram Post
• https://t.me/cvenotify/46531 · Telegram Post
• https://t.me/cvenotify/46169 · Telegram Post
• https://t.me/cvenotify/112705 · Telegram Post