CVE-2024-34102

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
AdobeAdobe Commerce<= 2.4.4-p8
adobecommerce<= 2.4.7; <= 2.4.6-p5; <= 2.4.5-p7; <= 2.4.4-p8; <= 2.4.3-ext-7; <= 2.4.2-ext-7; <= 2.4.1-ext-7; <= 2.4.0-ext-7; <= 2.3.7-p4-ext-7
adobecommerce<= 2.4.7; <= 2.4.6-p5; <= 2.4.5-p7; <= 2.4.4-p8; <= 2.4.3-ext-7; <= 2.4.2-ext-7; <= 2.4.1-ext-7; <= 2.4.0-ext-7; <= 2.3.7-p4-ext-7
adobecommerce<= 2.4.7; <= 2.4.6-p5; <= 2.4.5-p7; <= 2.4.4-p8; <= 2.4.3-ext-7; <= 2.4.2-ext-7; <= 2.4.1-ext-7; <= 2.4.0-ext-7; <= 2.3.7-p4-ext-7
adobecommerce<= 2.4.7; <= 2.4.6-p5; <= 2.4.5-p7; <= 2.4.4-p8; <= 2.4.3-ext-7; <= 2.4.2-ext-7; <= 2.4.1-ext-7; <= 2.4.0-ext-7; <= 2.3.7-p4-ext-7
adobecommerce<= 2.4.7; <= 2.4.6-p5; <= 2.4.5-p7; <= 2.4.4-p8; <= 2.4.3-ext-7; <= 2.4.2-ext-7; <= 2.4.1-ext-7; <= 2.4.0-ext-7; <= 2.3.7-p4-ext-7
adobecommerce<= 2.4.7; <= 2.4.6-p5; <= 2.4.5-p7; <= 2.4.4-p8; <= 2.4.3-ext-7; <= 2.4.2-ext-7; <= 2.4.1-ext-7; <= 2.4.0-ext-7; <= 2.3.7-p4-ext-7
adobecommerce<= 2.4.7; <= 2.4.6-p5; <= 2.4.5-p7; <= 2.4.4-p8; <= 2.4.3-ext-7; <= 2.4.2-ext-7; <= 2.4.1-ext-7; <= 2.4.0-ext-7; <= 2.3.7-p4-ext-7
adobecommerce<= 2.4.7; <= 2.4.6-p5; <= 2.4.5-p7; <= 2.4.4-p8; <= 2.4.3-ext-7; <= 2.4.2-ext-7; <= 2.4.1-ext-7; <= 2.4.0-ext-7; <= 2.3.7-p4-ext-7
adobecommerce<= 2.4.7; <= 2.4.6-p5; <= 2.4.5-p7; <= 2.4.4-p8; <= 2.4.3-ext-7; <= 2.4.2-ext-7; <= 2.4.1-ext-7; <= 2.4.0-ext-7; <= 2.3.7-p4-ext-7

References

Timeline

Published
Jun 13, 2024
Last modified
Jun 17, 2026
Added to CISA KEV
Jul 17, 2024
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-341038.1Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could CVE-2024-341048.2Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authorization vulnerability that could rCVE-2024-341054.8Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability thCVE-2024-341065.3Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Incorrect Authorization vulnerability that could CVE-2024-341079.8Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Access Control vulnerability that could CVE-2024-341087.2Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that coulCVE-2024-341097.2Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that coulCVE-2024-34119.1Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker toCVE-2024-341107.2Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vCVE-2024-341118.8Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability tCVE-2024-341127.5ColdFusion versions 2023u7, 2021u13 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary fileCVE-2024-341135.5ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a secur
CVE-2024-34102: Critical severity, CVSS 9.8 | Vulnix