High · 7.5 CVE-2023-27067 EUVD-2023-30856GHSA-xqrc-68p6-rf7p

Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via craf…

Published May 22, 2023 · Updated Jan 31, 2025 · Assigned by mitre

Description

Directory Traversal vulnerability in Sitecore Experience Platform through 10.2 allows remote attackers to download arbitrary files via crafted command to download.aspx

References

https://dev.sitecore.net/Downloads/Sitecore%20Experience%20Platform/103/Sitecore%20Experience%20Platform%20103/Release%20Notes
https://blogs.night-wolf.io/0-day-vulnerabilities-at-sitecore-pagedesigner