CVE-2025-34139highCWE-522CWE-552

CVE-2025-34139: fallo de gravedad alta en Sitecore Managed Cloud

Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Experience Platform+ Monitorear Experience Manager

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.5%
A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
Sitecore · Experience Commerce (XC)Sitecore · Experience Manager (XM)Sitecore · Experience Platform (XP)Sitecore · Managed Cloud
CVEs relacionadas — Sitecore Managed Cloud

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-53690CRITICALSitecore Products ViewState Deserialization VulnerabilityEPSS 60.7%KEVCVE-2025-53693CRITICALHTML Cache Poisoning through Unsafe ReflectionsEPSS 20.3%CVE-2025-53694HIGHInformation Disclosure in ItemServices APIEPSS 6.9%CVE-2025-53691HIGHSitecore Experience Remote Code Execution through Insecure DeserializationEPSS 1.6%CVE-2015-10142MEDIUMSitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known PathEPSS 0.6%CVE-2025-53692HIGHSitecore Experience Platform Cross-Site Scripting VulnerabilityEPSS 0.4%