Critical · published September 3, 2025
🚨 A crafty reflection vulnerability in Sitecore could turn your cache into a poison garden! 🔥 Think of it like a restaurant where an outside chef can decide what's on the menu — if they sneak in an unwanted dish, it could ruin the whole dining experience for your guests! This vulnerability allows an attacker to exploit externally-controlled input, potentially leading to cache poisoning. If left unaddressed, it could disrupt normal operations, serving poisoned data to users and affecting the integrity of your web applications.
Think of it like a restaurant where an outside chef can decide what's on the menu — if they sneak in an unwanted dish, it could ruin the whole dining experience for your guests! The 'Unsafe Reflection' vulnerability in Sitecore Experience Manager and Experience Platform allows attackers to leverage uncontrolled input for class or code selection, facilitating malicious cache manipulation.
This vulnerability allows an attacker to exploit externally-controlled input, potentially leading to cache poisoning. If left unaddressed, it could disrupt normal operations, serving poisoned data to users and affecting the integrity of your web applications. Update to Sitecore Experience Manager (XM) version 10.4.1 or later and Experience Platform (XP) version 10.4.1 or later to mitigate this issue. It's also crucial to conduct a thorough audit of your input handling and implement proper validation checks to prevent such vulnerabilities. You’ve got this! Patch those systems and fortify your defenses! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| sitecore/experience_commerce | ≥ 9.0, ≤ 10.4 | — |
| sitecore/experience_manager | ≥ 9.0, ≤ 10.4 | — |
| sitecore/experience_platform | ≥ 9.0, < 10.4 | 10.4 |
| sitecore/experience_platform | all versions | — |
| sitecore/managed_cloud | all versions | — |