Lucene search
HistoryMar 14, 2023 - 9:15 p.m.
CVE-2023-26262
sitecore
xp
xm
10.3
unrestricted
language file
upload
vulnerability
code execution
cm server
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
45.1%
An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload vulnerability exists the can lead to direct code execution on the content management (CM) server.
Affected configurations
Node
sitecoreexperience_managerRange≤10.3
ORsitecoreexperience_platformRange<10.3
| Vendor | Product | Version | CPE |
|---|---|---|---|
| sitecore | experience_manager | * | cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:* |
| sitecore | experience_platform | * | cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:* |
Related
cvelist
cvelist
CVE-2023-26262
2023-03-14 00:00:00
prion
prion
Unrestricted file upload
2023-03-14 21:15:00
cve
cve
CVE-2023-26262
2023-03-14 21:15:10
CVSS3
7.2
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS
0.001
Percentile
45.1%
Related for NVD:CVE-2023-26262