CVE-2024-34102criticalunder attackCWE-611

XXE can expose crypt key and other secrets granting full admin access

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%

from disclosure to weapon14 days

Published on NVDJun 13

1st PoC+14d

metasploitJun 11

CISA KEV+34d

exploitation probability

100%top 1% of all CVEs

observed exploitation

yesCISA + VulnCheck

40 public exploit(s)

Action required by CISAfederal deadline: 2024-08-07

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Researched and written with AI from the vendor advisory and public analysis, with the sources above. Always confirm the fixed version in the official advisory before acting.

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Adobe · Adobe Commerce

public PoCs found — 40

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://helpx.adobe.com/security/products/magento/apsb24-40.html https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102 https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102