CVE-2024-34102 is a critical Improper Restriction of XML External Entity Reference (XXE) vulnerability affecting Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier, which could lead to arbitrary code execution. With a CVSS score of 9.8 (CRITICAL), this vulnerability is remotely exploitable without user interaction, allowing attackers to achieve full compromise (confidentiality, integrity, availability). This vulnerability is actively exploited in the wild, with exploit modules available in Metasploit and Nuclei, and has garnered significant community discussion and media coverage due to its widespread impact on Adobe Commerce and Magento sites.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.4.2CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.2:-:*:*:*:*:*:* | ||
2.4.2CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.2:ext-1:*:*:*:*:*:* | ||
2.4.2CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.2:ext-2:*:*:*:*:*:* | ||
2.4.2CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.2:ext-3:*:*:*:*:*:* | ||
2.4.2CPE matchmatch criteria | cpe:2.3:a:adobe:commerce:2.4.2:ext-4:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.