Optimizely vulnerabilities
We track 6 vulnerabilities in Optimizely products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on January 4, 2025.
Latest Optimizely vulnerabilities
- 7.5 High severity
Optimizely CMS: Weak Password Requirements
An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS due to insufficient enforcement of password complexity requirements. The application permits users to set passwords with a minimum length
- 8.0 High severity
Optimizely CMS: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Optimizely EPiServer.CMS.Core before 12.32.0. A medium-severity vulnerability exists in the CMS, where the application does not properly validate uploaded files. This allows the upload of potentially malicious file types, including .
- 7.5 High severity
Configured Commerce: Use of HTTP Request With Sensitive Query String
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be
- 7.3 High severity
An issue was discovered in Optimizely Configured Commerce before 5.2.2408.
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessi
- 7.5 High severity
Configured Commerce: External Control of Assumed-Immutable Web Parameter
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where
- 8.1 High severity
Configured Commerce: Improper Neutralization of Input During Web Page Generation
In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed in users' browsers under specific conditions: XSS from client-side template injection in search history.