CVE-2023-33651

published 2023-06-06

CVE-2023-33651: An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0…

Priority P3 44 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
sitecore	experience_commerce	9.0 – 10.3	—
sitecore	experience_manager	9.0 – 10.3	—
sitecore	experience_platform	9.0 – 10.3	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-863