« Volver al listado

CVE-2025-34510

Estado: AnalizadaAlta (8.8)—

Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso autenticado en red (PR:L, AV:N). Zip Slip permite escritura arbitraria de archivos que conduce a ejecución de código en el servidor Sitecore. Impacto: ejecución de comandos (C:H, I:H) y manipulación de integridad de datos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementDisable or Remove Feature or ProgramVulnerability ScanningThreat Intelligence ProgramRestrict Web-Based ContentRestrict File and Directory Permissions

Tecnologías afectadas (4)

Sitecore — Experience CommerceSitecore — Experience ManagerSitecore — Experience PlatformSitecore — Managed Cloud

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-34510",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-34510",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-18T03:56:12.568004Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "Sitecore",
          "product": "Experience Manager",
          "versions": [
            {
              "status": "affected",
              "version": "9.0",
              "versionType": "custom",
              "lessThanOrEqual": "9.3"
            },
            {
              "status": "affected",
              "version": "10.0",
              "versionType": "custom",
              "lessThanOrEqual": "10.4"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sitecore",
          "product": "Experience Platform",
          "versions": [
            {
              "status": "affected",
              "version": "9.0",
              "versionType": "custom",
              "lessThanOrEqual": "9.3"
            },
            {
              "status": "affected",
              "version": "10.0",
              "versionType": "custom",
              "lessThanOrEqual": "10.4"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sitecore",
          "product": "Experience Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "9.0",
              "versionType": "custom",
              "lessThanOrEqual": "9.3"
            },
            {
              "status": "affected",
              "version": "10.0",
              "versionType": "custom",
              "lessThanOrEqual": "10.4"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-17T19:15:31.557",
  "references": [
    {
      "url": "https://labs.watchtowr.com/is-b-for-backdoor-pre-auth-rce-chain-in-sitecore-experience-platform/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP request to upload a ZIP archive containing path traversal sequences, allowing arbitrary file writes and leading to code execution."
    },
    {
      "lang": "es",
      "value": "Las versiones 9.0 a 9.3 y 10.0 a 10.4 de Sitecore Experience Manager (XM), Experience Platform (XP) y Experience Commerce (XC) se ven afectadas por una vulnerabilidad de Zip Slip. Un atacante remoto autenticado puede explotar este problema enviando una solicitud HTTP manipulada para cargar un archivo ZIP que contenga secuencias de path traversal, lo que permite escrituras arbitrarias en archivos y provoca la ejecución de código."
    }
  ],
  "lastModified": "2026-06-17T09:14:03.203",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sitecore:experience_commerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DCF77DC5-9DF9-4DF7-9636-69CA4BEEDB04",
              "versionEndIncluding": "10.4",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:sitecore:experience_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17EF29D0-E1DA-4F84-95F4-EA9680EB47DF",
              "versionEndIncluding": "10.4",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:sitecore:experience_platform:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88455751-A525-4A59-9DD8-4E015CD1346C",
              "versionEndExcluding": "10.4",
              "versionStartIncluding": "9.0"
            },
            {
              "criteria": "cpe:2.3:a:sitecore:experience_platform:10.4:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78E71AD1-04C7-4D80-9A0A-E386A3FAC860"
            },
            {
              "criteria": "cpe:2.3:a:sitecore:managed_cloud:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "520CF670-01A2-479F-B637-C413A82463E0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com"
}