CVE-2023-33651

An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://blog.assetnote.io/2023/05/10/sitecore-round-two/	Exploit Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925	Vendor Advisory
https://blog.assetnote.io/2023/05/10/sitecore-round-two/	Exploit Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sitecore:experience_commerce::::::::
	cpe:2.3:a:sitecore:experience_manager::::::::
	cpe:2.3:a:sitecore:experience_platform::::::::
	cpe:2.3:a:sitecore:managed_cloud:-:::::::*

History

No history.

Information

Published : 2023-06-06 19:15

Updated : 2025-01-08 17:15

NVD link : CVE-2023-33651

Mitre link : CVE-2023-33651

CVE.ORG link : CVE-2023-33651

JSON object : View

Products Affected

sitecore

managed_cloud
experience_commerce
experience_manager
experience_platform

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2023-33651", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-06-06T19:15:12.103", "references": [{"url": "https://blog.assetnote.io/2023/05/10/sitecore-round-two/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://blog.assetnote.io/2023/05/10/sitecore-round-two/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules."}], "lastModified": "2025-01-08T17:15:12.777", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5347D215-14FC-47E1-9B79-788DF656158B", "versionEndIncluding": "10.3", "versionStartIncluding": "9.0"}, {"criteria": "cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E6292DA1-E0C4-4253-9E47-4AB795C1A15C", "versionEndIncluding": "10.3", "versionStartIncluding": "9.0"}, {"criteria": "cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FED0DB4B-0E65-4419-ACDE-4BE8D4C5AA9A", "versionEndIncluding": "10.3", "versionStartIncluding": "9.0"}, {"criteria": "cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "520CF670-01A2-479F-B637-C413A82463E0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}