CVE-2023-33651: High severity Sitecore Experience Commerce vulnerability
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-33651?
CVE-2023-33651 is an issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release that allows attackers to bypass authorization rules.
What software versions are affected by CVE-2023-33651?
CVE-2023-33651 affects Sitecore Experience Commerce versions 9.0 to 10.3, Sitecore Experience Manager versions 9.0 to 10.3, Sitecore Experience Platform versions 9.0 to 10.3, and Sitecore Managed Cloud.
What is the severity of CVE-2023-33651?
CVE-2023-33651 has a severity of high (7.5).
How can attackers exploit CVE-2023-33651?
Attackers can exploit CVE-2023-33651 by bypassing authorization rules in the MVC Device Simulator of the affected Sitecore products.
Where can I find more information about CVE-2023-33651?
You can find more information about CVE-2023-33651 at the following references: [1] https://blog.assetnote.io/2023/05/10/sitecore-round-two/ [2] https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925