Sitecore XP 7.5 - 10.2, CMS 7.2, and Managed Cloud XSS
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitecore Shell users to be tricked into executing custom JS code. Managed Cloud Standard customers who run the affected Sitecore Experience Platform / CMS versions are also affected.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Sitecore Experience Platform
From 7.5 Initial Release · through 7.5 Update-2; From 8.0 Initial Release · through 8.0 Update-7; From 8.1 Initial Release · through 8.1 Update-3; From 8.2 Initial Release · through 8.2 Update-7; From 9.0 Initial Release · through 9.0 Update-2; From 9.1 Initial Release · through 9.1 Update 1; From 10.0 Initial Release · through 10.0 Update-3; From 10.1 Initial Release · through 10.1 Update-2
- Sitecore Content Mangement System (CMS)
From 7.2 Initial Release · through 7.2 Update-6
- Sitecore Managed Cloud
All versions