CVE-2024-34102

An attacker sends a crafted XML document containing references to external XML entities (XML External Entity). The application processes this document without appropriate restrictions, allowing the reading of system files, execution of requests to internal resources, or escalation to full code execution. The vulnerability is remotely accessible without requiring an account or any user interaction.

An attacker can gain full control of the server through arbitrary code execution (RCE), as well as compromise the confidentiality, integrity, and availability of the system.

Patches available from the vendor should be applied immediately in accordance with Adobe security bulletin APSB24-40 (https://helpx.adobe.com/security/products/magento/apsb24-40.html).

Adobe Commerce in versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8, and earlier.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.