High severity · published Sep 15, 2024
CVE-2024-46938
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release
7.5
CVSS
46.8%
EPSS
No
On KEV
Description
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)46.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Experience Commerce · Sitecore
8.0 through 10.4 · source: NVD
EM
Experience Manager · Sitecore
8.0 through 10.4 · source: NVD
EP
Experience Platform · Sitecore
8.0 through 10.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-46938
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-46938
Vendor Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003408
More from Experience Commerce
9.0
CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
9.8
CVE-2025-53693
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP)…
9.8
CVE-2023-35813
Multiple Sitecore products allow remote code execution
8.8
CVE-2025-53691
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Remote Code Execution (RCE).This issue affects…
8.8
CVE-2025-34511
Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue