CVE-2024-34102
CISA KEV ActiveTitle: Adobe Commerce Webhooks XML External Entity (XXE)
XML External Entity (XXE)
Proof Of Concept
PoC Available for CVE-2024-34102
CWE Category
CWE-611
Published Date
Jun 13, 2024
Modified Date
Oct 23, 2025
Exploit Status
Available
Score
9.8
CVSS v3.1
Exploit Probability (EPSS)
99.99%
Vulnerability Summary
CVE-2024-34102: Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
Impacted Vendors
Reference Links
https://helpx.adobe.com/security/products/magento/apsb24-40.html
https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102
https://helpx.adobe.com/security/products/magento/apsb24-40.html
https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102
CVSS v3.1
Source Entity
[email protected]
Severity
CRITICAL
9.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Associated Attack Patterns (CAPEC)
Total: PatternsNo specific attack patterns mapped.
Likelihood
Severity
Page /
CVE-2024-34102 Exploits & PoCs (Proof Of Concept)
MODIFIED
Vulnerability data or affected products updated.
PUBLISHED
Vulnerability first announced in NVD.
Attack Vector Matrix
Access Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
CVSS Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Stack
No specific products linked.