CVEvulnerability

CVE-2025-34509

7.5 HIGH Published 2025-06-17 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2025-06-17
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-798

Description

Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attackers can use this account to access administrative API over HTTP.

Affected configurations

• sitecore experience commerce (>= 9.0 <= 10.4) • sitecore experience manager (>= 9.0 <= 10.4) • sitecore experience platform (>= 9.0 < 10.4) • sitecore experience platform 10.4 • sitecore managed cloud

Related

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References