CVE-2025-27218 Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization · CloudMap

中危CVE-2025-27218

Sitecore Experience Manager (XM)/Experience Platform (XP) 10.4 - Insecure Deserialization

披露于 2025/02/20 · 更新于 2025/10/13

CVSS 评分5.3/ 10.0

EPSS 概率57.2%百分位 98.0%

漏洞描述

Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

RELATED INTELLIGENCE

与 SiteCore 相关的其他公开漏洞。

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
CVE-2025-34509 Sitecore Experience Manager (XM) and Experience Platform (XP) - Hardcoded Credentials SiteCore	高危	7.5	—	PoCEXP	2025/06/17
CVE-2024-46938RCE Sitecore Experience Platform <= 10.4 - Arbitrary File Read SiteCore	高危	7.5	91.9%	PoCEXP	2024/06/03
sitecore_lfi Sitecore 9.3 - Webroot File Read SiteCore	高危	—	—	PoCEXP	2024/01/15
sitecore_debug_page SiteCore Debug Page SiteCore	低危	—	—	PoCEXP	2024/01/15
CVE-2023-35813RCE Sitecore - Remote Code Execution SiteCore	严重	9.8	93.5%	PoCEXP	2023/06/18
CVE-2021-42237 Sitecore Experience Platform Pre-Auth RCE SiteCore	严重	9.8	94.4%	PoCEXP	2021/11/05