CVE-2025-34511
BaseFortify
Publication date: 2025-06-17
Last updated on: 2025-09-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sitecore | experience_commerce | From 9.0 (inc) to 10.4 (inc) |
| sitecore | experience_manager | From 9.0 (inc) to 10.4 (inc) |
| sitecore | experience_platform | From 9.0 (inc) to 10.4 (exc) |
| sitecore | experience_platform | 10.4 |
| sitecore | managed_cloud | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Sitecore PowerShell Extensions up to version 7.0, where an authenticated remote attacker can upload arbitrary files to the server via crafted HTTP requests. This unrestricted file upload can lead to remote code execution on the affected server.
How can this vulnerability impact me? :
The vulnerability can allow an attacker with valid authentication to upload malicious files to the server, potentially leading to remote code execution. This can result in full compromise of the affected system, including data theft, service disruption, or further attacks within the network.