High severity · published Jun 6, 2023
CVE-2023-33651
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release…
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
An issue in the MVC Device Simulator of Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) v9.0 Initial Release to v13.0 Initial Release allows attackers to bypass authorization rules.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Experience Commerce · Sitecore
9.0 through 10.3 · source: NVD
EM
Experience Manager · Sitecore
9.0 through 10.3 · source: NVD
EP
Experience Platform · Sitecore
9.0 through 10.3 · source: NVD
MC
Managed Cloud · Sitecore
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33651
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33651
Exploit
https://blog.assetnote.io/2023/05/10/sitecore-round-two/
Vendor Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1002925
More from Experience Commerce
9.0
CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
9.8
CVE-2025-53693
HTML Cache Poisoning through Unsafe Reflections
9.8
CVE-2023-35813
Multiple Sitecore products allow remote code execution
8.8
CVE-2025-53691
Sitecore Experience Remote Code Execution through Insecure Deserialization
8.8
CVE-2025-34511
Sitecore PowerShell Extension RCE via Unrestricted Upload