CVE-2024-46938 Information disclosure in n/a
Unauthenticated attackers can read arbitrary files in Sitecore Experience Platform, Experience Manager, and Experience Commerce.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-46938?
CVE-2024-46938 is a high-severity vulnerability in n/a, published on 15 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.
Weakness: CWE-200
Which versions are affected by CVE-2024-46938?
It affects 3 products.
Products include Sitecore Experience Commerce, Sitecore Experience Manager, Sitecore Experience Platform.
How do I fix CVE-2024-46938?
No fix has been published for CVE-2024-46938 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-46938 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-46938 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2025-53690 Sitecore Multiple Products Deserialization of Untrusted Data
- CVE-2025-53693 HTML Cache Poisoning through Unsafe Reflections
- CVE-2023-35813 Code injection in n/a
- CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization
- CVE-2025-34510 Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
Sources
Also known as GHSA-5fx5-p3qx-6q26.