Authenticated Remote Code Execution in Sitecore Experience Platform
CVE-2023-33652

8.8HIGH

Key Information:

Vendor

Sitecore

Status
Experience Platform
Vendor
CVE Published:
6 June 2023

What is CVE-2023-33652?

The Sitecore Experience Platform (XP) v9.3 has been identified with a vulnerability that allows an authenticated attacker to execute arbitrary code remotely via the /sitecore/shell/Invoke.aspx component. This poses significant risks as it grants the potential for unauthorized control over the affected system, jeopardizing the integrity and confidentiality of user data.

References

https://blog.assetnote.io/2023/05/10/sitecore-round-two/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.