CVE-2024-341029.8Critical
XXE can expose crypt key and other secrets granting full admin access
Adobe · Commerce and Magento Open Source
Exploited in the wild · in CISA KEV since 17 Jul 2024Vendor fix available
99.9%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
9.8CriticalCVSS
LowMediumHighCrit.
Federal deadline
CISA KEV · added 17 Jul · catalogue entry
Passed 811 days ago
DescriptionNVD
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CoverageNo articles yet
No CyberSIXT article names CVE-2024-34102 yet. New articles appear here and in the RSS feed.