7.5Alta
CVE-2025-53694Information Disclosure in ItemServices API
Descripción
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
Debilidad (CWE):
CWE-200
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| sitecore | experience commerce | 9.2 – ≤ 10.4 | |
| sitecore | experience manager | 9.2 – ≤ 10.4 | |
| sitecore | experience platform | 9.2 – < 10.4 | |
| Sitecore | Experience Platform (XP) | 9.2 – ≤ 10.4 | |
| sitecore | managed cloud | — | |
| Sitecore | Sitecore Experience Manager (XM) | 9.2 – ≤ 10.4 |
Referencias y parches
- https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-cache-poisoning-to-rce/ ExploitThird Party Advisory
- https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003734 Vendor Advisory
Coincidencias CPE (NVD) (5)
cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*≥ 9.2 ≤ 10.4cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*≥ 9.2 ≤ 10.4cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*≥ 9.2 < 10.4cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:*cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*