CVE-2023-33651 Missing authorization in n/a
Attackers can bypass authorization rules in the MVC Device Simulator of Sitecore Experience Platform, Experience Manager, and Experience Commerce.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-33651?
CVE-2023-33651 is a high-severity missing authorization vulnerability in n/a, published on 6 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.
Weakness: CWE-863
Which versions are affected by CVE-2023-33651?
It affects 4 products.
Products include Sitecore Experience Commerce, Sitecore Experience Manager, Sitecore Experience Platform, Sitecore Managed Cloud.
How do I fix CVE-2023-33651?
No fix has been published for CVE-2023-33651 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-33651 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-33651 exists.
Other vulnerabilities in n/a
- CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted Data
- CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections
- CVE-2023-35813 Code injection in n/a
- CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization
- CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
Sources
Also known as GHSA-c9gv-w7pg-cx22.