Every CVE Search/ Get API key

CVE-2024-34111

SSRF in service connector

6.5 MediumFix available

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.27%Up 1.2 points since Jun 14, 2024
90%50%10%1%

What each source reports

CVE List Score used 6.5

SSRF in service connector

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

Record
CVE-2024-34111
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
EUVDEUVD-2024-2094 6.5

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

Record
EUVD-2024-2094
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-jmqp-r3gg-6jh3 6.3

Magento Open Source Server-Side Request Forgery (SSRF) vulnerability

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted request to the server, which could then cause the server to execute arbitrary code. Exploitation of this issue does not require user interaction.

Record
GHSA-jmqp-r3gg-6jh3
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
NVD 6.5

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

Record
CVE-2024-34111
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-918
Updated
2026-11-02
OSV 6.5

SSRF in service connector

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

Record
CVE-2024-34111
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVGHSA-jmqp-r3gg-6jh3 6.3

Magento Open Source Server-Side Request Forgery (SSRF) vulnerability

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted request to the server, which could then cause the server to execute arbitrary code. Exploitation of this issue does not require user interaction.

Record
GHSA-jmqp-r3gg-6jh3
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-918
Updated
2026-11-02
OSVBIT-magento-2024-34111 No score

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of arbitrary URLs. Exploitation of this issue does not require user interaction..

Record
BIT-magento-2024-34111
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
magento/community-edition
Packagist
 2.4.7 to 2.4.7 None known
magento/community-edition
Packagist
 2.4.6 to 2.4.6 None known
magento/community-edition
Packagist
 2.4.5 to 2.4.5 None known
magento/community-edition
Packagist
 2.4.4 to 2.4.4 None known
magento/community-edition
Packagist
 2.4.6-p1 up to 2.4.6-p6
2.4.6-p6
magento/community-edition
Packagist
 2.4.5-p1 up to 2.4.5-p8
2.4.5-p8
magento/community-edition
Packagist
 before 2.4.4-p9
2.4.4-p9
magento
Bitnami
 2.4.7-alpha0 up to 2.4.7-p1, 2.4.6-alpha0 up to 2.4.6-p6, 2.4.5-alpha0 up to 2.4.5-p8, 2.4.4-alpha0 up to 2.4.4-p9
2.4.7-p12.4.6-p62.4.5-p82.4.4-p9
magento/community-edition
Packagist
 Listed versions
2.4.7
 None known
magento/community-edition
Packagist
 Listed versions
2.4.6
 None known
Show 5 moreShow less
Affected packages
PackageAffectedFixed
magento/community-edition
Packagist
 Listed versions
2.4.5
 None known
magento/community-edition
Packagist
 Listed versions
2.4.4
 None known
magento/community-edition
Packagist
 2.4.6-p1 up to 2.4.6-p6, plus listed versions
2.4.6-p22.4.6-p32.4.6-p42.4.6-p5
2.4.6-p6
magento/community-edition
Packagist
 2.4.5-p1 up to 2.4.5-p8, plus listed versions
2.4.5-p22.4.5-p32.4.5-p42.4.5-p52.4.5-p62.4.5-p7
2.4.5-p8
magento/community-edition
Packagist
 before 2.4.4-p9, plus listed versions
0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104
Show 45 moreShow less
0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta1.0.0-beta21.0.0-beta3
2.4.4-p9

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-34111 is a medium vulnerability (CVSS 6.5) in Adobe Commerce, published June 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.27%, the 70th percentile. Fixed in magento/community-edition 2.4.6-p6.

References

This page doesn't list everything

Left out here: 96 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open