← voltar
CVE-2024-34102criticalsob ataqueCWE-611

XXE can expose crypt key and other secrets granting full admin access

100Vexday Risk Score

Corrija agora. Ela está sob exploração confirmada pelo CISA e tem exploit funcional público.

ssvc Actcvss 9.8epss 100%
da publicação à arma14 dias
Publicada no NVD13 de jun.
1ª PoC+14d
metasploit11 de jun.
CISA KEV+34d
probabilidade de exploração
100%top 1% das CVEs
exploração observada
simCISA + VulnCheck
40 exploit(s) público(s)
Ação exigida pela CISAprazo federal: 2024-08-07

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Pesquisado e redigido com IA a partir do advisory do fornecedor e de análises públicas, com as fontes acima. Confira sempre a versão corrigida no advisory oficial antes de agir.
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Adobe · Adobe Commerce
PoCs públicas encontradas — 40
githubgithub.com/Chocapikk/CVE-2024-34102★ 48githubgithub.com/bigb0x/CVE-2024-34102★ 31githubgithub.com/th3gokul/CVE-2024-34102★ 14githubgithub.com/jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento★ 9githubgithub.com/bughuntar/CVE-2024-34102★ 5githubgithub.com/EQSTLab/CVE-2024-34102★ 4githubgithub.com/11whoami99/CVE-2024-34102★ 3githubgithub.com/0x0d3ad/CVE-2024-34102★ 2githubgithub.com/wubinworks/magento2-cosmic-sting-patch★ 1githubgithub.com/Phantom-IN/CVE-2024-34102★ 1githubgithub.com/nmmorette/CVE-2024-34102★ 1githubgithub.com/Kento-Sec/CVE-2024-34102★ 0githubgithub.com/russellwork2021-lgtm/cosmicsting-cve-2024-34102-exploit★ 0githubgithub.com/ArturArz1/TestCVE-2024-34102★ 0githubgithub.com/d0rb/CVE-2024-34102★ 0githubgithub.com/cmsec423/CVE-2024-34102★ 0githubgithub.com/cmsec423/Magento-XXE-CVE-2024-34102★ 0githubgithub.com/SamJUK/cosmicsting-validator★ 0githubgithub.com/unknownzerobit/poc★ 0githubgithub.com/crynomore/CVE-2024-34102★ 0githubgithub.com/dream434/CVE-2024-34102★ 0githubgithub.com/bka/magento-cve-2024-34102-exploit-cosmicstring★ 0githubgithub.com/wubinworks/magento2-encryption-key-manager-cli★ 0githubgithub.com/Koray123-debug/CVE-2024-34102★ 0vulncheckvulncheck.com/xdb/68297a933a3cnão verificadovulncheckvulncheck.com/xdb/62c07de93469não verificadovulncheckvulncheck.com/xdb/e10072b9959anão verificadovulncheckvulncheck.com/xdb/e16ac34e34d7não verificadovulncheckvulncheck.com/xdb/f7ec53083d00não verificadovulncheckvulncheck.com/xdb/56d612cb301bnão verificadovulncheckvulncheck.com/xdb/b740eaf30da0não verificadovulncheckvulncheck.com/xdb/ff651d9ccadfnão verificadovulncheckvulncheck.com/xdb/b9a5654f364dnão verificadovulncheckvulncheck.com/xdb/2eb4d44dc79bnão verificadovulncheckvulncheck.com/xdb/18320f3f459cnão verificadovulncheckvulncheck.com/xdb/771b0f9ad8b9não verificadovulncheckvulncheck.com/xdb/31319adbe12anão verificadovulncheckvulncheck.com/xdb/60b0937b5f4fnão verificadovulncheckvulncheck.com/xdb/dc00179a0cb9não verificadovulncheckvulncheck.com/xdb/034f54dfbdb8não verificado
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://helpx.adobe.com/security/products/magento/apsb24-40.htmlhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102