CVE-2025-34511

{"id": "CVE-2025-34511", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-06-17T19:15:31.683", "references": [{"url": "https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/", "source": "disclosure@vulncheck.com"}, {"url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using crafted HTTP requests, resulting in remote code execution."}, {"lang": "es", "value": "Las extensiones de PowerShell de Sitecore, un complemento para Sitecore Experience Manager (XM) y Experience Platform (XP), hasta la versi\u00f3n 7.0, son vulnerables a un problema de carga de archivos sin restricciones. Un atacante remoto y autenticado puede cargar archivos arbitrarios al servidor mediante solicitudes HTTP manipuladas, lo que provoca la ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2025-07-22T14:15:33.957", "sourceIdentifier": "disclosure@vulncheck.com"}