Sitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the component /sitecore/shell/Invoke.aspx.
The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Experience_platform | Sitecore | 9.3 (including) | 9.3 (including) |