CVE-2024-46938

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-469392.4The game extension engine of versions 1.2.7.0 and earlier exposes some components, and attackers can construct parameters to perform path tr CVE-2024-469414.8SystemUI has an incorrect component protection setting, which allows access to specific information.CVE-2024-469426.5In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entries CVE-2024-469437.5An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3. A rogue controller can join a clu CVE-2024-469469.8langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sy CVE-2024-469476.5Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF.CVE-2024-469484.3Northern.tech Mender before 3.6.5 and 3.7.x before 3.7.5 has Incorrect Access Control.CVE-2024-46955.4The Move Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, CVE-2024-469517.8An issue was discovered in psi/zcolor.c in Artifex Ghostscript before 10.04.0. An unchecked Implementation pointer in Pattern color space co CVE-2024-469527.8An issue was discovered in pdf/pdf_xref.c in Artifex Ghostscript before 10.04.0. There is a buffer overflow during handling of a PDF XRef st CVE-2024-469537.8An issue was discovered in base/gsdevice.c in Artifex Ghostscript before 10.04.0. An integer overflow when parsing the filename format strin CVE-2024-469547.8An issue was discovered in decode_utf8 in base/gp_utf8.c in Artifex Ghostscript before 10.04.0. Overlong UTF-8 encoding leads to possible ..