8.8Hoch
CVE-2025-53691Sitecore Experience Remote Code Execution through Insecure Deserialization
Beschreibung
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
Schwachstellentyp (CWE):
CWE-502
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| sitecore | experience commerce | 9.0 – ≤ 10.4 | |
| sitecore | experience manager | 9.0 – ≤ 10.4 | |
| Sitecore | Experience Manager (XM) | 9.0 – ≤ 9.3, 10.0 – ≤ 10.4 | |
| sitecore | experience platform | 9.0 – < 10.4 | |
| Sitecore | Experience Platform (XP) | 9.0 – ≤ 9.3, 10.0 – ≤ 10.4 | |
| sitecore | managed cloud | — |
Referenzen und Patches
- https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/ ExploitThird Party Advisory
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667 Vendor Advisory
CPE-Treffer (NVD) (5)
cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*≥ 9.0 ≤ 10.4cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*≥ 9.0 ≤ 10.4cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*≥ 9.0 < 10.4cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:*cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*