Critical Sitecore Vulnerability Resolved: Immediate Patch Required for Unauthenticated File Read Risk

 


Critical Vulnerability in Sitecore Software (SC2024-001-619349)

Sitecore has identified and resolved a critical vulnerability (SC2024-001-619349) that poses a risk of unauthenticated arbitrary file reads. A patch is now available to address this issue, and Sitecore strongly urges all customers and partners to promptly apply the fix to all affected instances.

Impacted Products

The vulnerability affects the following Sitecore products:

  • Experience Manager (XM)
  • Experience Platform (XP)
  • Experience Commerce (XC)
  • Managed Cloud

Non-Impacted Products

The following Sitecore products are not affected by this vulnerability:

  • XM Cloud
  • Content Hub
  • CDP and Personalize (formerly Boxever)
  • OrderCloud (formerly Four51 OrderCloud)
  • Storefront (formerly Four51 Storefront)
  • Moosend
  • Send
  • Discover (formerly Reflektion)
  • Search
  • Commerce Server

Affected Versions

The vulnerability impacts all Experience Platform topologies (XM, XP, XC) from version 8.0 Initial Release to 10.4 Initial Release. This includes Content Management (CM) and Standalone instances, PaaS solutions, and containerized solutions. Managed Cloud customers running the affected Experience Platform versions are also impacted, specifically CM and Standalone Managed Cloud instances.

Solution

To mitigate the issue, Sitecore recommends applying the following patch to affected systems:

  1. For Versions 9.1 to 10.4 Initial Release:
    • Download and unpack the Sitecore.Support.619349.zip archive.
    • Place the Sitecore.Support.619349.dll in the \bin folder.
    • Place the Sitecore.Support.619349.config in the \App_Config\Include\zzz folder.
  2. For Versions 9.0.2 and Earlier:
    • Download and unpack the Sitecore.Support.61934-8.0.0-9.0.2.0.zip archive.
    • Place the Sitecore.Support.619349.dll in the \bin folder.
    • Place the Sitecore.Support.619349.config in the \App_Config\Include\zzz folder.

Sitecore is currently preparing hotfixes, which will be available soon.

Important Information

  • The vulnerability impacts only the Content Management (CM) and Standalone roles within Sitecore XP.
  • In the Azure Marketplace, hotfixes are not automatically rolled out and must be applied manually.
  • Versions 9.0.2 and earlier have entered the Sustaining Support Phase, and Sitecore does not provide hotfix packages for them. Therefore, Sitecore recommends upgrading to later versions and applying the corresponding hotfix.

 To ensure the security of your Sitecore instances, apply the necessary patches immediately and keep your environments up to date with the latest security fixes. Stay vigilant and proactive in maintaining the integrity of your Sitecore deployments.

For more information, please visit this Sitecore KB article

Location: Kolkata, West Bengal, India

Comments

Post a Comment

Popular posts from this blog

Setup New Project in Sitecore XMCloud – Part 1

Image
In my previous blog , I discussed about the XMCloud Introduction and features of XMCloud. In this blog I will show, how to create a new Project and environments in the Sitecore XM cloud. In the next blog, I will show how easily you can set up your local app development for XM Cloud and run the Sitecore XM Cloud project on your development machine. Prerequisites: • You must have one Organization account in Sitecore portal ( https://portal.sitecorecloud.io/ ) which has access to XMCloud.  And your account should be associated with that Organization account with admin access.  • Organization must have proper Sitecore licensing to run the XMCloud site in local docker environments. • Create your own Github account to link with XMCloud project. Steps to setup your project 1. Click on “Manage My projects” menu to open https://deploy.sitecorecloud.io/projects.io/projects site to Create a new project or manage existing one. 2. Then click on “Create New Project” button to cr...
Read more

Step by Step installation of Sitecore 10.3 on Docker

Image
  In this document, we will learn how to setup Sitecore 10.3 on docker desktop in Windows 11. We shall briefly cover the step-by-step process and overview of Sitecore 10.3 setup. While doing the installation in my windows, I followed Installation Guide for Developer Workstation with Containers . Thanks, Sitecore Team! Prerequisites - To setup Sitecore 10.3 on docker, we shall need the following - Docker Desktop Installed on Windows Desktop Docker Desktop support for windows containers 16 GB of RAM Approximately 50GB of free disk space for Sitecore container images. SSD storage is highly recommended. The default Sitecore container configuration uses specific ports. To avoid any conflicts, we should ensure the following ports are not being used by another process: 443, 8079, 8081, 8984, and 14330 To check the prerequisites for Sitecore 10.3 installation, please check the below link - Support Information - Sitecore compatibility table for Sitecore XP 9.0 and later Setup Files - Docker...
Read more

Step by Step installation of Sitecore 10.3 on Azure PaaS

Image
  In this document we will learn how to setup Sitecore 10.3 XP on Azure PaaS. We shall briefly cover the step by step process and overview of Sitecore 10.3 XP setup. While doing the installation, I follow Deploying a new Sitecore environment to the Microsoft Azure App service . Thanks, Sitecore Team! Prerequisites: To setup Sitecore 10.3 on Azure PaaS, we shall need the following: Check PowerShellGet Module. If not found please install PowerShell Gallery Install the Azure Az PowerShell module. Download Sitecore Azure Toolkit 2.8.0 . This will provide a zip file that can be extracted and used for setup.  Deployment Topologies We will do the setup for Sitecore 10.3 XP. Sitecore XP product edition is the full Sitecore Experience Platform, which includes all Sitecore roles and services, including xConnect. This is a Sitecore Experience Platform configuration that runs: Three Sitecore roles: Content Delivery, Content Management, and Processing, as a single WebA...
Read more