Lucene search

[email protected]CVE-2023-33651

HistoryJun 06, 2023 - 7:15 p.m.

CVE-2023-33651

2023-06-0619:15:12

CWE-863

[email protected]

web.nvd.nist.gov

cve-2023-33651

sitecore experience platform

experience manager

experience commerce

authorization bypass

security issue

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.4%

JSON

An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.

Affected configurations

NVD

Node

sitecoreexperience_commerceRange9.0–10.3

sitecoreexperience_managerRange9.0–10.3

sitecoreexperience_platformRange9.0–10.3

sitecoremanaged_cloudMatch-

CPENameOperatorVersion
sitecore:experience_commercesitecore experience commercele10.3
sitecore:experience_managersitecore experience managerle10.3
sitecore:experience_platformsitecore experience platformle10.3
sitecore:managed_cloudsitecore managed cloudeq-

CPE	Name	Operator	Version
sitecore:experience_commerce	sitecore experience commerce	le	10.3
sitecore:experience_manager	sitecore experience manager	le	10.3
sitecore:experience_platform	sitecore experience platform	le	10.3
sitecore:managed_cloud	sitecore managed cloud	eq	-

References

blog.assetnote.io/2023/05/10/sitecore-round-two/

support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.4%

JSON

Related for CVE-2023-33651

cvelist1 prion1 nvd1