High severity · published Sep 15, 2024
CVE-2024-46938
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release
7.5
CVSS
46.8%
EPSS
No
On KEV
Description
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)46.8% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EC
Experience Commerce · Sitecore
8.0 through 10.4 · source: NVD, CISA
EM
Experience Manager · Sitecore
8.0 through 10.4 · source: NVD, CISA
EP
Experience Platform · Sitecore
8.0 through 10.4 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-46938
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-46938
Vendor Advisory
https://support.sitecore.com/kb?id=kb_article_view&sysparm_article=KB1003408
More from Experience Commerce
9.0
CVE-2025-53690
Sitecore Products ViewState Deserialization Vulnerability
9.8
CVE-2025-53693
HTML Cache Poisoning through Unsafe Reflections
9.8
CVE-2023-35813
Multiple Sitecore products allow remote code execution
8.8
CVE-2025-53691
Sitecore Experience Remote Code Execution through Insecure Deserialization
8.8
CVE-2025-34511
Sitecore PowerShell Extension RCE via Unrestricted Upload