CVE Feed

    Dashboard / CVE / CVE-2024-34102

    CVE-2024-34102

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

    Published:Jun 13, 2024
    Last Modified:Oct 23, 2025
    EPS:Jun 13, 2024
    EPSS Score:0.94101
    CVSS Score:9.8

    CISA Notification

    Description

    Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

    Required Action:

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Notes:

    No extra notes provided.

    Due Date
    Aug 7, 2024
    765 days ago
    Alert Date
    Jul 17, 2024
    786 days ago

    Affected Products

    Vendor
    Adobe
    Product
    Commerce
    Vendor
    Adobe
    Product
    Commerce Webhooks
    Vendor
    Adobe
    Product
    Magento

    Exploits

    https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102https://github.com/0x0d3ad/CVE-2024-34102https://github.com/11whoami99/CVE-2024-34102https://github.com/ArturArz1/TestCVE-2024-34102https://github.com/bigb0x/CVE-2024-34102https://github.com/bka/magento-cve-2024-34102-exploit-cosmicstringhttps://github.com/bughuntar/CVE-2024-34102https://github.com/bughuntar/CVE-2024-34102-Pythonhttps://github.com/Chocapikk/CVE-2024-34102https://github.com/cmsec423/CVE-2024-34102https://github.com/cmsec423/Magento-XXE-CVE-2024-34102https://github.com/crynomore/CVE-2024-34102https://github.com/d0rb/CVE-2024-34102https://github.com/dream434/CVE-2024-34102https://github.com/EQSTLab/CVE-2024-34102https://github.com/jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magentohttps://github.com/Kento-Sec/CVE-2024-34102https://github.com/Koray123-debug/CVE-2024-34102https://github.com/mksundaram69/CVE-2024-34102https://github.com/nmmorette/CVE-2024-34102https://github.com/Phantom-IN/CVE-2024-34102https://github.com/russellwork2021-lgtm/cosmicsting-cve-2024-34102-exploithttps://github.com/SamJUK/cosmicsting-validatorhttps://github.com/th3gokul/CVE-2024-34102https://github.com/unknownzerobit/pochttps://github.com/wubinworks/magento2-cosmic-sting-patchhttps://github.com/wubinworks/magento2-encryption-key-manager-cli

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-221 Data Serialization External Entities Blowup

    Related CVEs

    CVE-2026-76200 (CVSS 9.3) — Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an att…
    CVE-2026-76201 (CVSS 9.3) — Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an att…
    CVE-2026-77109 (CVSS 8.6) — Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalati…
    CVE-2026-77110 (CVSS 7.6) — Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'…
    CVE-2026-77108 (CVSS 7.5) — Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalati…
    CVE-2026-76202 (CVSS 8.2) — Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalati…
    CVE-2026-77774 (CVSS 8.6) — Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature…
    CVE-2026-77111 (CVSS 8.7) — Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature…
    CVE-2026-75650 (CVSS 10) — Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnera…
    CVE-2026-47998 (CVSS 5.9) — Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High