8.8Hoch
CVE-2025-34510Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
Beschreibung
Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.
Schwachstellentyp (CWE):
CWE-23
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Sitecore | Experience Commerce | 9.0 – ≤ 9.3, 10.0 – ≤ 10.4 | |
| Sitecore | Experience Manager | 9.0 – ≤ 9.3, 10.0 – ≤ 10.4 | |
| Sitecore | Experience Platform | 9.0 – ≤ 9.3, 10.0 – ≤ 10.4 | |
| sitecore | managed cloud | — |
Referenzen und Patches
- https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/ third-party-advisoryexploittechnical-descriptionExploit
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667 vendor-advisoryVendor Advisory
CPE-Treffer (NVD) (5)
cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*≥ 9.0 ≤ 10.4cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*≥ 9.0 ≤ 10.4cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*≥ 9.0 < 10.4cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:*cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*