CVE-2023-33651

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.assetnote.io/2023/05/10/sitecore-round-two/Exploit, Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925Vendor Advisory
https://blog.assetnote.io/2023/05/10/sitecore-round-two/Exploit, Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925Vendor Advisory

Timeline

Published: Jun 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-336528.8Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componen CVE-2023-336538.8Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componen CVE-2023-336565.5A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vuln CVE-2023-336577.5A use-after-free vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_mqtt_msg_get_publish_CVE-2023-336587.5A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_msg_get_pub_pid CVE-2023-336597.5A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nmq_subinfo_decode(CVE-2023-33664.3The MultiParcels Shipping For WooCommerce WordPress plugin before 1.15.2 does not have CRSF check when deleting a shipment, allowing attacke CVE-2023-336607.5A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function copyn_str() in the CVE-2023-336616.1Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and CVE-2023-336639.8In the module “Customization fields fee for your store” (aicustomfee) from ai-dev module for PrestaShop, an attacker can perform SQL injecti CVE-2023-336648.8ai-dev aicombinationsonfly before v0.3.1 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php.CVE-2023-336659.8ai-dev aitable before v0.2.2 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php.