Every CVE Search/ Get API key

CVE-2024-34102

XXE can expose crypt key and other secrets granting full admin access

9.8 CriticalIn KEVPublic exploitFix available

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

100.0%Up 99.9 points since Jun 14, 2024
90%50%10%1%

What each source reports

CVE List Score used 9.8

XXE can expose crypt key and other secrets granting full admin access

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Record
CVE-2024-34102
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-611
Updated
2026-11-02
EUVDEUVD-2024-2102 9.8

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Record
EUVD-2024-2102
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-m8cj-3v68-3cxj 9.8

Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Record
GHSA-m8cj-3v68-3cxj
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-611
Updated
2026-11-02
CISA KEV No score

Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.

Record
CVE-2024-34102
Weakness
CWE-611
Updated
2026-11-02
NVD 9.8

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Record
CVE-2024-34102
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-611
Updated
2026-11-02
OSV 9.8

XXE can expose crypt key and other secrets granting full admin access

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Record
CVE-2024-34102
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-611
Updated
2026-11-02
OSVGHSA-m8cj-3v68-3cxj 9.8

Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Record
GHSA-m8cj-3v68-3cxj
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-611
Updated
2026-11-02
OSVBIT-magento-2024-34102 No score

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Record
BIT-magento-2024-34102
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
magento/community-edition
Packagist
 2.4.4 to 2.4.4 None known
magento/community-edition
Packagist
 2.4.6-p1 up to 2.4.6-p6
2.4.6-p6
magento/community-edition
Packagist
 2.4.5-p1 up to 2.4.5-p8
2.4.5-p8
magento/community-edition
Packagist
 before 2.4.4-p9
2.4.4-p9
magento/community-edition
Packagist
 2.4.5 to 2.4.5 None known
magento/community-edition
Packagist
 2.4.6 to 2.4.6 None known
magento/community-edition
Packagist
 2.4.7 to 2.4.7 None known
magento
Bitnami
 2.4.7-alpha0 up to 2.4.7-p1, 2.4.6-alpha0 up to 2.4.6-p6, 2.4.5-alpha0 up to 2.4.5-p8, 2.4.4-alpha0 up to 2.4.4-p9
2.4.7-p12.4.6-p62.4.5-p82.4.4-p9
magento/community-edition
Packagist
 Listed versions
2.4.4
 None known
magento/community-edition
Packagist
 2.4.6-p1 up to 2.4.6-p6, plus listed versions
2.4.6-p22.4.6-p32.4.6-p42.4.6-p5
2.4.6-p6
Show 5 moreShow less
Affected packages
PackageAffectedFixed
magento/community-edition
Packagist
 2.4.5-p1 up to 2.4.5-p8, plus listed versions
2.4.5-p22.4.5-p32.4.5-p42.4.5-p52.4.5-p62.4.5-p7
2.4.5-p8
magento/community-edition
Packagist
 before 2.4.4-p9, plus listed versions
0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104
Show 45 moreShow less
0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta1.0.0-beta21.0.0-beta3
2.4.4-p9
magento/community-edition
Packagist
 Listed versions
2.4.5
 None known
magento/community-edition
Packagist
 Listed versions
2.4.6
 None known
magento/community-edition
Packagist
 Listed versions
2.4.7
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubArturArz1/TestCVE-2024-341022024-06-27
PoC in GitHubbigb0x/CVE-2024-341022024-06-27
PoC in GitHubth3gokul/CVE-2024-341022024-06-27
PoC in GitHub11whoami99/CVE-2024-341022024-06-28
PoC in GitHubChocapikk/CVE-2024-341022024-06-28
PoC in GitHubd0rb/CVE-2024-341022024-06-28
PoC in GitHub0x0d3ad/CVE-2024-341022024-06-30
PoC in GitHubjakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento2024-07-01
PoC in GitHubSamJUK/cosmicsting-validator2024-07-07
PoC in GitHubunknownzerobit/poc2024-07-08
Show 17 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubcrynomore/CVE-2024-341022024-07-11
PoC in GitHubbughuntar/CVE-2024-341022024-07-13
PoC in GitHubPhantom-IN/CVE-2024-341022024-07-14
MetasploitCosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)2024-07-26
PoC in GitHubwubinworks/magento2-cosmic-sting-patch2024-08-08
PoC in GitHubEQSTLab/CVE-2024-341022024-08-13
PoC in GitHubdream434/CVE-2024-341022024-08-19
PoC in GitHubbka/magento-cve-2024-34102-exploit-cosmicstring2024-10-08
PoC in GitHubwubinworks/magento2-encryption-key-manager-cli2024-12-04
PoC in GitHubmksundaram69/CVE-2024-341022025-01-07
PoC in GitHubKoray123-debug/CVE-2024-341022025-04-06
PoC in GitHubKento-Sec/CVE-2024-341022025-08-14
PoC in GitHubnmmorette/CVE-2024-341022026-02-13
PoC in GitHubrussellwork2021-lgtm/cosmicsting-cve-2024-34102-exploit2026-05-25
PoC in GitHubbigcartenergy/module-cosmicsting-patch2026-11-07
MetasploitMagento XXE Unserialize Arbitrary File Read2024-06-11
NucleiAdobe Commerce & Magento - CosmicSting

History

History
RecordedChangedSources
exploitsPoC in GitHub
exploitation
exploits
exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-34102 is a critical vulnerability (CVSS 9.8) in Adobe Commerce, published June 13, 2024. CISA lists it as known to be exploited, since July 17, 2024. EUVD reports exploitation since July 17, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 100.0%, the 99th percentile. Fixed in magento/community-edition 2.4.6-p6.

References

Show 6 moreShow less
This page doesn't list everything

Left out here: 96 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open