PT-2023-25331 · Sitecore+1 · Sitecore Experience Commerce+3

Published 2023-06-17 · Updated 2025-11-27 · CVE-2023-35813

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sitecore Experience Manager versions through 10.3 Sitecore Experience Platform versions through 10.3 Sitecore Experience Commerce versions through 10.3

Description Multiple Sitecore products are affected by a remote code execution issue. This allows for the execution of arbitrary code on affected systems. An actor is actively exploiting this issue, with detections observed from AS 55836 (Reliance Jio Infocomm Limited) using NetNut Residential Proxy addresses. A state health corporation with annual revenue between $1 and $1.5 billion USD has been targeted, and details about the exploitation of the ASP.NET TemplateParser are available. The vulnerability resides in the processing of ASP.NET templates. The TemplateParser component is vulnerable. No specific API endpoints or vulnerable parameters are mentioned.

Recommendations For Sitecore Experience Manager versions through 10.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Sitecore Experience Platform versions through 10.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Sitecore Experience Commerce versions through 10.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-35813

Affected Products

Asp.Net

Sitecore Experience Commerce

Sitecore Experience Manager

Sitecore Experience Platform

References · 30

• 🔥 https://github.com/aalexpereira/CVE-2023-35813 · Exploit
• 🔥 https://github.com/BagheeraAltered/CVE-2023-35813-PoC · Exploit
• https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002979 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35813 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35813 · Vendor Advisory
• https://twitter.com/e11i0t_4lders0n/status/1738451178172862591 · Twitter Post
• https://twitter.com/_r_netsec/status/1706635503557341289 · Twitter Post
• https://twitter.com/0xbool/status/1848524706863059389 · Twitter Post
• https://twitter.com/tbbhunter/status/1706660823492673710 · Twitter Post
• https://t.me/cvenotify/52578 · Telegram Post
• https://t.me/thebugbountyhunter/7811 · Telegram Post
• https://twitter.com/e11i0t_4lders0n/status/1738451066281398490 · Twitter Post
• https://twitter.com/ksg93rd/status/1742032530306457683 · Twitter Post
• https://twitter.com/MonThreat/status/1869778294918525195 · Twitter Post
• https://twitter.com/KahuLabs_/status/1854483267006906385 · Twitter Post