9.8 CVE-2025-53693

Enriched by CISA Exploit

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
https://nvd.nist.gov/vuln/detail/CVE-2025-53693

Categories

CWE-470 : Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
If the product uses external inputs to determine which class to instantiate or which method to invoke, then an attacker could supply values to select unexpected classes or methods. If this occurs, then the attacker could create control flow paths that were not intended by the developer. These paths could bypass authentication or access control checks, or otherwise cause the product to behave in an unexpected manner. This situation becomes a doomsday scenario if the attacker can upload files into a location that appears on the product's classpath (CWE-427) or add new entries to the product's classpath (CWE-426). Under either of these conditions, the attacker can use reflection to introduce new, malicious behavior into the product.

References

9947ef80-c5d5-474a-bbab-97341a59000e Exploit

https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-c... Exploit Third Party Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003667 Vendor Advisory

AFFECTED (from MITRE)

Vendor	Product	Versions
Sitecore	Sitecore Experience Manager (XM)	9.0 ≤ 9.3 [affected] 10.0 ≤ 10.4 [affected]
Sitecore	Experience Platform (XP)	9.0 ≤ 9.3 [affected] 10.0 ≤ 10.4 [affected]
© 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

CPE

cpe	start	end
Configuration 1
cpe:2.3:a:sitecore:experience_commerce::::::::	>= 9.0	<= 10.4
cpe:2.3:a:sitecore:experience_manager::::::::	>= 9.0	<= 10.4
cpe:2.3:a:sitecore:experience_platform::::::::	>= 9.0	< 10.4
cpe:2.3:a:sitecore:experience_platform:10.4:-::::::
cpe:2.3:a:sitecore:managed_cloud:-:::::::*

REMEDIATION

EXPLOITS

Exploit-db.com

id	description	date
No known exploits

POC Github

Url
No known exploits

Other Nist (github, ...)

Url
https://labs.watchtowr.com/cache-me-if-you-can-sitecore-experience-platform-c...

CAPEC

Common Attack Pattern Enumerations and Classifications

id	description	severity
138	Reflection Injection An adversary supplies a value to the target application which is then used by reflection methods to identify a class, method, or field. For example, in the Java programming language the reflection libraries permit an application to inspect, load, and invoke classes and their components by name. If an adversary can control the input into these methods including the name of the class/method/field or the parameters passed to methods, they can cause the targeted application to invoke incorrect methods, read random fields, or even to load and utilize malicious classes that the adversary created. This can lead to the application revealing sensitive information, returning incorrect results, or even having the adversary take control of the targeted application.	Very High

Cybersecurity needs ?

Strengthen software security from the outset with our DevSecOps expertise

Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.

Discover this offer

Soutenez No Hack Me sur Tipeee