CVE-2025-34139

A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthenticated attacker to read arbitrary files. This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected.

CVSS

No CVSS.

References

Link	Resource
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003650
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003661
https://www.vulncheck.com/advisories/sitecore-xm-xp-xc-managed-cloud-arbitrary-file-read

Configurations

No configuration.

History

29 Jul 2025, 14:14

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad en Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC) y Managed Cloud que podría permitir que un atacante no autenticado lea archivos arbitrarios. Esta vulnerabilidad afecta a todas las topologías de Experience Platform (XM, XP, XC) desde la versión inicial 8.0 hasta la versión inicial 10.4 y posteriores. Este problema afecta a Content Management (CM) e instancias independientes. Las soluciones PaaS y en contenedores también se ven afectadas.

25 Jul 2025, 19:15

Type	Values Removed	Values Added
CWE		CWE-552

25 Jul 2025, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-25 16:15

Updated : 2025-07-29 14:14

NVD link : CVE-2025-34139

Mitre link : CVE-2025-34139

CVE.ORG link : CVE-2025-34139

JSON object : View

Products Affected

No product.

CWE

CWE-552

Files or Directories Accessible to External Parties

{"id": "CVE-2025-34139", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-25T16:15:28.913", "references": [{"url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003650", "source": "disclosure@vulncheck.com"}, {"url": "https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003661", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/sitecore-xm-xp-xc-managed-cloud-arbitrary-file-read", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-552"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Sitecore\u00a0Experience Manager (XM),\u00a0Experience Platform (XP),\u00a0Experience Commerce (XC), and\u00a0Managed Cloud that could allow an unauthenticated attacker to read arbitrary files.\u00a0This vulnerability affects all Experience Platform topologies (XM, XP, XC) from 8.0 Initial Release through 10.4 Initial Release and later. This issue affects Content Management (CM) and standalone instances. PaaS and containerized solutions are also affected."}, {"lang": "es", "value": "Existe una vulnerabilidad en Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC) y Managed Cloud que podr\u00eda permitir que un atacante no autenticado lea archivos arbitrarios. Esta vulnerabilidad afecta a todas las topolog\u00edas de Experience Platform (XM, XP, XC) desde la versi\u00f3n inicial 8.0 hasta la versi\u00f3n inicial 10.4 y posteriores. Este problema afecta a Content Management (CM) e instancias independientes. Las soluciones PaaS y en contenedores tambi\u00e9n se ven afectadas."}], "lastModified": "2025-07-29T14:14:55.157", "sourceIdentifier": "disclosure@vulncheck.com"}