IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
9.8Critical KEV

CVE-2024-34102XXE can expose crypt key and other secrets granting full admin access

Adobe Adobe Commerce; adobe commerce Published: (2 years ago)

Known exploited — Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

CISA confirmed this vulnerability is used in real attacks on 17.07.2024. Remediation deadline for US federal agencies: 07.08.2024.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://helpx.adobe.com/security/products/magento/apsb24-40.html; https://nvd.nist.gov/vuln/detail/CVE-2024-34102

Description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Weakness (CWE): CWE-611

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
Adobe Adobe Commerce ≤ 2.4.4-p8
adobe commerce ≤ 2.4.7, ≤ 2.4.6-p5, ≤ 2.4.5-p7, ≤ 2.4.4-p8, ≤ 2.4.3-ext-7, ≤ 2.4.2-ext-7, ≤ 2.4.1-ext-7, ≤ 2.4.0-ext-7, ≤ 2.3.7-p4-ext-7
adobe commerce webhooks 1.2.0 – < 1.5.0
adobe magento 2.4.4

References and patches

CPE matches (NVD) (59)
  • cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.2:ext-7:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.3:ext-1:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.3:ext-2:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.3:ext-3:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.3:ext-4:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.3:ext-7:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.4:-:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.4:p1:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.4:p2:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.4:p3:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.4:p4:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.4:p5:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.4:p6:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.5:-:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.5:p1:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.5:p2:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.5:p3:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.5:p4:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.5:p5:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.6:-:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.6:p1:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.6:p2:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.6:p3:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.6:p5:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.7:-:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce_webhooks:*:*:*:*:*:*:*:* ≥ 1.2.0 < 1.5.0
  • cpe:2.3:a:adobe:magento:2.4.4:-:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.4:p1:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.4:p2:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.4:p3:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.4:p4:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.4:p5:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.4:p6:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.4:p7:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.4:p8:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.5:-:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.5:p1:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.5:p2:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.5:p3:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.5:p4:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.5:p5:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.5:p6:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.5:p7:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.6:-:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.6:p1:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.6:p2:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.6:p3:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.6:p4:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.6:p5:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.7:-:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.7:b1:*:*:open_source:*:*:*

Recent CVEs in the same product — Adobe Commerce / Magento

8.7High
CVE-2026-95631

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitatio…

7.2High
CVE-2026-92910

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation …

9.3Critical
CVE-2026-91013

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the pag…

9.1Critical
CVE-2026-92464

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitatio…

4.3Medium
CVE-2026-95630

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of…