{"id":"CVE-2024-34102","kind":"vulnerability","aliases":["CVE-2024-34102"],"related":[],"title":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of…","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.","summary":"Adobe Commerce and Magento Open Source have an XML external entity (XXE) flaw that lets an attacker make the server parse attacker-supplied XML. The sources say it allows remote code execution, and CISA lists it as actively exploited.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-07-17T00:00:00+00:00","products":[{"name":"Adobe Commerce and Magento Open Source","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.2","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.3","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.4","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.5","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.6","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.7","ecosystem":"vendor"},{"name":"adobe commerce webhooks","fixed":["1.5.0"],"affected":">= 1.2.0, < 1.5.0","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.4","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.5","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.6","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.7","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-commerce","exploited","magento","package","self-hosted"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the mitigations and patch from Adobe's security bulletin for CVE-2024-34102, or stop using the affected product if no mitigation exists (per CISA required action).","status":"open","published_at":"2024-06-13T09:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:33+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:58:33Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and patch from Adobe's security bulletin for CVE-2024-34102, or stop using the affected product if no mitigation exists (per CISA required action).\nunknown","reach":"internet","impact":"high","summary":"Adobe Commerce and Magento Open Source have an XML external entity (XXE) flaw that lets an attacker make the server parse attacker-supplied XML. The sources say it allows remote code execution, and CISA lists it as actively exploited.","category":"package","who_cares":["adobe-commerce","magento","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the store server and may read files or secrets","analyst_note":"Find Adobe's bulletin for CVE-2024-34102 to get affected and fixed versions, the exact mitigation steps, and a check method; the sources given do not list versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000477,"input_tokens":2849,"output_tokens":384,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':20A,23A '-34102':21A,24A '2.4.4':9A,111C '2.4.5':7A,109C '2.4.6':5A,107C '2.4.7':4A,106C 'activ':101B 'adob':1A,55B,63B,103C 'adobe':25A,31A,33A,35A,37A,39A,41A,43A,46A,48A,50A,52A 'adobe-commerc':54B 'affect':14A,116C 'allow':92B 'and':27A 'arbitrari':132C 'attack':79B,85B,136C 'attacker-suppli':84B 'cisa':97B 'code':94B,133C 'commerc':2A,56B,64B,104C 'commerce':26A,32A,34A,36A,38A,40A,42A,44A 'could':129C,137C 'craft':144C 'cve':19A,22A 'document':146C 'earlier':12A,114C 'entiti':73B,124C,150C 'execut':95B,134C 'exploit':57B,102B,138C,151C 'extern':72B,123C,149C 'flaw':75B 'host':62B 'improp':17A,119C 'interact':159C 'issu':154C 'let':77B 'list':98B 'magento':28A,47A,49A,51A,53A,58B,66B 'make':80B 'open':29A,67B 'p5':6A,108C 'p7':8A,110C 'p8':10A,112C 'packag':59B 'pars':83B 'refer':125C,148C 'remot':93B 'requir':157C 'restrict':18A,120C 'result':130C 'say':90B 'self':61B 'self-host':60B 'send':142C 'server':82B 'sourc':68B,89B 'source':30A 'suppli':86B 'user':158C 'version':3A,105C 'vulner':127C,140C 'webhooks':45A 'xml':71B,87B,122C,145C 'xxe':74B,126C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-06-13T09:15:10+00:00","kev":{"dateAdded":"2024-07-17","dueDate":"2024-08-07","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-34102","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-34102","severity":null,"published_at":"2024-07-17T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-34102","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34102","severity":null,"published_at":"2024-06-13T09:15:10+00:00","modified_at":"2026-06-17T07:32:54+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}