CVE-2025-34139highCWE-522CWE-552

CVE-2025-34139: falha de alta gravidade em Sitecore Managed Cloud

Sitecore XM/XP/XC and Managed Cloud 8.0 - 10.4 Arbitrary File Read

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Experience Platform+ Monitorar Experience Manager

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.5%
A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Sitecore · Experience Commerce (XC)Sitecore · Experience Manager (XM)Sitecore · Experience Platform (XP)Sitecore · Managed Cloud
CVEs relacionadas — Sitecore Managed Cloud

No mesmo produto, das mais perigosas para as menos.

CVE-2025-53690CRITICALSitecore Products ViewState Deserialization VulnerabilityEPSS 60.7%KEVCVE-2025-53693CRITICALHTML Cache Poisoning through Unsafe ReflectionsEPSS 20.3%CVE-2025-53694HIGHInformation Disclosure in ItemServices APIEPSS 6.9%CVE-2025-53691HIGHSitecore Experience Remote Code Execution through Insecure DeserializationEPSS 1.6%CVE-2015-10142MEDIUMSitecore XP < 8.0 and CMS < 7.2 and < 7.5 File Read via Known PathEPSS 0.6%CVE-2025-53692HIGHSitecore Experience Platform Cross-Site Scripting VulnerabilityEPSS 0.4%