# CVE-2024-46938: CVE-2024-46938

- Exploited (CISA KEV): no
- Published: 2024-09-15
- CVSS: 7.5 HIGH (v3.1)
- EPSS: 46.8% (99th percentile)

An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-03-17 | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | Rule published | 2025-04-28 | 225 |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-03-17 · updated · rule 83a677f082264693ad64a2827ee56b66 · default Block
  > Sitecore - Remote Code Execution - CVE:CVE-2024-46938. Previous action: Log. New action: Block.
  Source: https://developers.cloudflare.com/changelog/post/2025-03-17-waf-release/

### F5

- 2025-04-28 · new · rule 200007086
  > Added: signature 200007086 "Sitecore Arbitrary File Read" (Path Traversal, risk High), systems: ASP, ASP.NET. References: CVE-2024-46938.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog
- 2025-05-22 · new · rule 200007086
  > Added: signature 200007086 "Sitecore Arbitrary File Read" (Path Traversal, risk High), systems: ASP, ASP.NET. References: CVE-2024-46938.
  Source: https://docs.cloud.f5.com/docs-v2/platform/changelogs/security-details-changelog

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: partial (2 of 3 requests blocked), template CVE-2024-46938, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: partial (2 of 3 requests blocked), template CVE-2024-46938, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-46938 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-46938