CVE-2024-46938: Infoleak
An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-46938?
CVE-2024-46938 has been classified as a high severity vulnerability due to the potential for unauthorized file access by unauthenticated attackers.
How can I fix CVE-2024-46938?
To mitigate CVE-2024-46938, upgrade Sitecore Experience Platform, Experience Manager, and Experience Commerce to versions above 10.4 if currently running on 8.0 through 10.4.
Which versions are affected by CVE-2024-46938?
CVE-2024-46938 impacts Sitecore Experience Platform, Experience Manager, and Experience Commerce versions from 8.0 Initial Release through 10.4 Initial Release.
What type of access does an attacker gain with CVE-2024-46938?
An attacker exploiting CVE-2024-46938 can read arbitrary files on the affected Sitecore installations without requiring authentication.
Is there a workaround for CVE-2024-46938?
Currently, the recommended action for CVE-2024-46938 is to upgrade to a secure version as there are no established workarounds.