Adobe Commerce Webhooks vulnerabilities

10 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 0 published in the last 12 months.

Exploited Adobe Commerce Webhooks vulnerabilities

CVE-2024-34102 — Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

CVE-2024-34111 — SSRF in service connector (CVSS 8.8)
CVE-2024-34110 — RCE in the Adobe Commerce Webhook module through a legit webhook definition (CVSS 7.2)
CVE-2024-34109 — Adobe Commerce | Improper Input Validation (CWE-20) (CVSS 7.2)
CVE-2024-34108 — Large attack surface through legit webhook usage in Adobe Commerce (CVSS 7.2)
CVE-2024-34107 — Adobe Commerce | Improper Access Control (CWE-284) (CVSS 9.8)
CVE-2024-34106 — Insecure Direct Object Reference - An attacker can able to erase the victim quote details (CVSS 5.3)
CVE-2024-34105 — Stored Cross Site Scripting in Order Comment (CVSS 4.8)
CVE-2024-34104 — Adobe Commerce | Improper Authorization (CWE-285) (CVSS 8.2)
CVE-2024-34103 — Customer account takeover via web API call & subsequent password reset (CVSS 8.1)
CVE-2024-34102 — Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability (CVSS 9.8) — exploited