Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Sitecore Arbitrary File Read (CVE-2024-46938) - Vulnerability Database

Sitecore Arbitrary File Read (CVE-2024-46938)

Description

The web application uses Sitecore platform. This version of Sitecore platform has an arbitrary file read vulnerability. Successful exploitation of the vulnerability can result in takeover of the server.

Remediation

Upgrade to the latest version of Sitecore

References

Security Bulletin SC2024-001-619349
Leveraging An Order of Operations Bug to Achieve RCE in Sitecore 8.x - 10.x

Related Vulnerabilities

Cleo Harmony/VLTrader/LexiCom RCE (CVE-2024-50623, CVE-2024-55956) Critical
Common tags: Arbitrary File Read Known Vulnerabilities
Vite Arbitrary File Read (CVE-2025-30208, CVE-2025-31125) High
Common tags: Arbitrary File Read Known Vulnerabilities
CakePHP 1.3.5 / 1.2.8 unserialize() vulnerability High
Common tags: Known Vulnerabilities
WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-9787) High
Common tags: Known Vulnerabilities
PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2019-9641) Critical
Common tags: Known Vulnerabilities

Severity

High

Classification

CVE-2024-46938
CWE-200
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Arbitrary File Read
Known Vulnerabilities