Adobe · Commerce and Magento Open Source
CVE-2024-34102
XXE can expose crypt key and other secrets granting full admin access
Nedir
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
CISA: Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
Ne yapmalı
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
ABD federal kurumları için son tarih: 7 Ağustos 2024
Adobe için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 15 Şub 2022 | Improper Input Validation | Commerce and Magento Open Source | Kritik 9,8 | 99,2% |
| 27 Eki 2026 | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | Kritik 9,3 | 31% |
| 24 Eyl 2026 | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | Kritik 9,1 | 90% |
| 8 Eyl 2026 | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | Kritik 10,0 | 3,9% |
| 7 Tem 2026 | Path Traversal | ColdFusion | Kritik 10,0 | 42% |
| 20 May 2026 | Heap-Based Buffer Overflow | Acrobat and Reader | Yüksek 8,8 | 87% |
| 13 Nis 2026 | Use-After-Free | Acrobat | Yüksek 7,8 | 33% |
| 13 Nis 2026 | Prototype Pollution | Acrobat and Reader | Yüksek 8,6 | 7,2% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.