Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

The version of Adobe Commerce/Magento Open Source installed on the remote host falls within one of the following ranges   2.4.7 < 2.4.7-p1 (Adobe Commerce) / 2.4.6 < 2.4.6-p6 (Adobe Commerce) / 2.4.5 < 2.4.5-p8 (Adobe Commerce)   / 2.4.4 < 2.4.4-p9 (Adobe Commerce) / 2.4.3 < 2.4.3-ext-8 (Adobe Commerce) / 2.4.2 < 2.4.2-ext-8 (Adobe Commerce) /   2.4.7 < 2.4.7-p1 (Magento Open Source) / 2.4.6 < 2.4.6-p6 (Magento Open Source) / 2.4.5 < 2.4.5-p8 (Magento Open Source)   and  2.4.4 < 2.4.4-p9 (Magento Open Source) 

 It is, therefore, affected by a XXE vulnerability as referenced in the APSB24-40 advisory.

  - Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of     XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker     could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation     of this issue does not require user interaction. (CVE-2024-34102)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper
    Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code
    execution. An attacker could exploit this vulnerability by sending a crafted XML document that references
    external entities. Exploitation of this issue does not require user interaction. (CVE-2024-34102)

The Magento application running on the remote web server is affected by an XML external entity injection (XXE) vulnerability due to improper parsing of XML data with nested deserialization. A remote, unauthenticated attacker can exploit this vulnerability, via HTTP, to execute arbitrary code on the remote host.

Adobe Magento Open Source / Commerce versions 2.4.7 < 2.4.7-p1, 2.4.6 < 2.4.6-p6, 2.4.5 < 2.4.5-p8, 2.4.4 < 2.4.4-p9 and earlier suffer from an XML External Entity (XXE) vulnerability. By exploiting this vulnerability and crafting a malicious XML document, a remote and unauthenticated attacker could achieve Remote Code Execution (RCE) on the vulnerable Magento instance.

ID	Name	Product	Family	Severity
255220	Adobe Commerce/Magento XXE Vulnerability (APSB24-40)	Nessus	Misc.	critical
416839	SCA: security update for magento/community-edition (GHSA-m8cj-3v68-3cxj)	Tenable Cloud Security	SCA Checks	critical
416839	SCA: security update for magento/community-edition (GHSA-m8cj-3v68-3cxj)	Tenable Self-Hosted Container Security	SCA Checks	critical
206274	Magento XXE (CVE-2024-34102)	Nessus	CGI abuses	critical
114325	Adobe Commerce / Magento XML External Entity Injection (CosmicSting)	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-34102

critical

Tenable Plugins

critical

critical

critical

critical

critical