CVE-2023-33651
First published: Tue Jun 06 2023(Updated: )
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Sitecore | >=9.0<=10.3 | |
| Sitecore CMS and Experience Platform (XP) | >=9.0<=10.3 | |
| Sitecore | >=9.0<=10.3 | |
| Sitecore |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-33651?
CVE-2023-33651 is an issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release that allows attackers to bypass authorization rules.
What software versions are affected by CVE-2023-33651?
CVE-2023-33651 affects Sitecore Experience Commerce versions 9.0 to 10.3, Sitecore Experience Manager versions 9.0 to 10.3, Sitecore Experience Platform versions 9.0 to 10.3, and Sitecore Managed Cloud.
What is the severity of CVE-2023-33651?
CVE-2023-33651 has a severity of high (7.5).
How can attackers exploit CVE-2023-33651?
Attackers can exploit CVE-2023-33651 by bypassing authorization rules in the MVC Device Simulator of the affected Sitecore products.
Where can I find more information about CVE-2023-33651?
You can find more information about CVE-2023-33651 at the following references: [1] https://blog.assetnote.io/2023/05/10/sitecore-round-two/ [2] https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/sitecore
- canonical/sitecore
- version/sitecore/9.0
- version/sitecore/10.3
- canonical/sitecore cms and experience platform (xp)
- version/sitecore cms and experience platform (xp)/9.0
- version/sitecore cms and experience platform (xp)/10.3