CVE-2024-34102

CVE Published	2024-06-13
Related CWE(s)	CWE-611: Improper Restriction of XML External Entity Reference
Related Vendor(s)	adobe
Related Product(s)	commerce_webhooks, magento, commerce
Exploitation Reported (CISA KEV)	2024-07-17
CVSS 3 Base Score	9.8 (CRITICAL)
CVSS 3 Attack Complexity	LOW
CVSS 3 Attack Vector	NETWORK

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Cyber Threat Graph Context

Explore how this CVE relates to the wider threat graph

Associated CAPEC Patterns

Data Serialization External Entities Blowup (CAPEC-221)

This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.

References

CVE-2024-34102

Cyber Threat Graph Context

Associated CAPEC Patterns

Data Serialization External Entities Blowup (CAPEC-221)

References

CVE.org

NIST National Vulnerability Database

CISA Known Exploited Vulnerabilities