← volver
CVE-2024-34102criticalbajo ataqueCWE-611

XXE can expose crypt key and other secrets granting full admin access

100Vexday Risk Score

Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.

ssvc Actcvss 9.8epss 100%
de la publicación al arma14 días
Publicada en NVD13 jun
1ª PoC+14d
metasploit11 jun
CISA KEV+34d
probabilidad de explotación
100%top 1% de las CVE
explotación observada
síCISA + VulnCheck
40 exploit(s) público(s)
Acción exigida por CISAplazo federal: 2024-08-07

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Investigado y redactado con IA a partir del advisory del fabricante y análisis públicos, con las fuentes citadas. Verifica siempre la versión corregida en el advisory oficial antes de actuar.
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Adobe · Adobe Commerce
PoCs públicas encontradas — 40
githubgithub.com/Chocapikk/CVE-2024-34102★ 48githubgithub.com/bigb0x/CVE-2024-34102★ 31githubgithub.com/th3gokul/CVE-2024-34102★ 14githubgithub.com/jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento★ 9githubgithub.com/bughuntar/CVE-2024-34102★ 5githubgithub.com/EQSTLab/CVE-2024-34102★ 4githubgithub.com/11whoami99/CVE-2024-34102★ 3githubgithub.com/0x0d3ad/CVE-2024-34102★ 2githubgithub.com/wubinworks/magento2-cosmic-sting-patch★ 1githubgithub.com/Phantom-IN/CVE-2024-34102★ 1githubgithub.com/nmmorette/CVE-2024-34102★ 1githubgithub.com/Kento-Sec/CVE-2024-34102★ 0githubgithub.com/russellwork2021-lgtm/cosmicsting-cve-2024-34102-exploit★ 0githubgithub.com/ArturArz1/TestCVE-2024-34102★ 0githubgithub.com/d0rb/CVE-2024-34102★ 0githubgithub.com/cmsec423/CVE-2024-34102★ 0githubgithub.com/cmsec423/Magento-XXE-CVE-2024-34102★ 0githubgithub.com/SamJUK/cosmicsting-validator★ 0githubgithub.com/unknownzerobit/poc★ 0githubgithub.com/crynomore/CVE-2024-34102★ 0githubgithub.com/dream434/CVE-2024-34102★ 0githubgithub.com/bka/magento-cve-2024-34102-exploit-cosmicstring★ 0githubgithub.com/wubinworks/magento2-encryption-key-manager-cli★ 0githubgithub.com/Koray123-debug/CVE-2024-34102★ 0vulncheckvulncheck.com/xdb/68297a933a3cno verificadovulncheckvulncheck.com/xdb/62c07de93469no verificadovulncheckvulncheck.com/xdb/e10072b9959ano verificadovulncheckvulncheck.com/xdb/e16ac34e34d7no verificadovulncheckvulncheck.com/xdb/f7ec53083d00no verificadovulncheckvulncheck.com/xdb/56d612cb301bno verificadovulncheckvulncheck.com/xdb/b740eaf30da0no verificadovulncheckvulncheck.com/xdb/ff651d9ccadfno verificadovulncheckvulncheck.com/xdb/b9a5654f364dno verificadovulncheckvulncheck.com/xdb/2eb4d44dc79bno verificadovulncheckvulncheck.com/xdb/18320f3f459cno verificadovulncheckvulncheck.com/xdb/771b0f9ad8b9no verificadovulncheckvulncheck.com/xdb/31319adbe12ano verificadovulncheckvulncheck.com/xdb/60b0937b5f4fno verificadovulncheckvulncheck.com/xdb/dc00179a0cb9no verificadovulncheckvulncheck.com/xdb/034f54dfbdb8no verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://helpx.adobe.com/security/products/magento/apsb24-40.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102