Security Bulletin SC2016-003-136430

  • Description

    We are reporting a Critical vulnerability (SC2016-003-136430), for an open source component (Sitecore PowerShell Extensions), which the Sitecore Experience Accelerator is dependent upon. You are also at risk if you used the open source Sitecore PowerShell Extensions module in other projects.

    Please note that the Sitecore PowerShell Extensions module is not distributed with Sitecore software and is not a part of the default Sitecore Installation.

    We encourage Sitecore customers and partners to familiarize themselves with the information below and apply the recommended fix to all affected Sitecore systems.

    If you'd like to receive security notifications by email, please sign-up for our security notifications list here:
    http://www.sitecore.net/landing/xc/2016/xc-ops-sitecore-security-notifications

  • Severity Definitions

  • Versions affected

    Vulnerability 2016-003-136430 affects the following versions of Sitecore that have the Sitecore PowerShell Extensions module installed:

    • All versions of Sitecore 7.0—8.2 with Sitecore PowerShell Extensions versions 3.0—4.2
    • All versions of Sitecore 6.x—7.x with Sitecore PowerShell Extensions up to version 2.8

    This vulnerability impacts all Sitecore systems running the above-mentioned versions. This includes CMS-only and xDB-enabled modes, single-instance and multi-instance environments, and all Sitecore server roles (content delivery, content management, reporting, processing, publishing, etc). It also impacts Sitecore-based intranet sites.

  • More Information

Applies to:

SXA 1+, CMS 6+

December 13, 2016
December 16, 2016

Reference number:

136430

Keywords: 

  • Security Vulnerabilities,
  • SXA