What’s Vulnerable › Vulnerabilities

CVE-2024-34102: Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-07-17
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-13 · updated 2026-06-17
• Weakness: CWE-611

Description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Affected products

• Adobe Commerce: 2.4.2, 2.4.2-ext-1, 2.4.2-ext-2, 2.4.2-ext-3, 2.4.2-ext-4, 2.4.2-ext-7 (+27)
• Adobe Commerce Webhooks: from 1.2.0 before 1.5.0 — fixed in 1.5.0
• Adobe Magento: 2.4.4, 2.4.4-p1, 2.4.4-p2, 2.4.4-p3, 2.4.4-p4, 2.4.4-p5 (+19)

How to fix

Upgrade to a fixed version: Adobe Commerce Webhooks 1.5.0. Check the vendor advisory for mitigations.

References

• https://helpx.adobe.com/security/products/magento/apsb24-40.html
• https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102
• https://helpx.adobe.com/security/products/magento/apsb24-40.html
• https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102

Get alerted when CVE-2024-34102 or the next vulnerability affects your stack