{"id":"CVE-2024-34102","aliases":["BIT-magento-2024-34102","EUVD-2024-2102","GHSA-m8cj-3v68-3cxj"],"status":"published","title":"XXE can expose crypt key and other secrets granting full admin access","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.99994,"percentile":0.99987,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-611"],"published":"2024-06-13T09:04:56Z","modified":"2026-10-28T02:31:01Z","kev":{"date_added":"2024-07-17","due_date":"2024-08-07","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-07-17"},{"source":"kev","since":"2024-07-17"}],"exploits":[{"source":"pocgithub","id":"ArturArz1/TestCVE-2024-34102","title":"ArturArz1/TestCVE-2024-34102","date":"2024-06-27","url":"https://github.com/ArturArz1/TestCVE-2024-34102"},{"source":"pocgithub","id":"bigb0x/CVE-2024-34102","title":"bigb0x/CVE-2024-34102","date":"2024-06-27","url":"https://github.com/bigb0x/CVE-2024-34102"},{"source":"pocgithub","id":"th3gokul/CVE-2024-34102","title":"th3gokul/CVE-2024-34102","date":"2024-06-27","url":"https://github.com/th3gokul/CVE-2024-34102"},{"source":"pocgithub","id":"11whoami99/CVE-2024-34102","title":"11whoami99/CVE-2024-34102","date":"2024-06-28","url":"https://github.com/11whoami99/CVE-2024-34102"},{"source":"pocgithub","id":"Chocapikk/CVE-2024-34102","title":"Chocapikk/CVE-2024-34102","date":"2024-06-28","url":"https://github.com/Chocapikk/CVE-2024-34102"},{"source":"pocgithub","id":"d0rb/CVE-2024-34102","title":"d0rb/CVE-2024-34102","date":"2024-06-28","url":"https://github.com/d0rb/CVE-2024-34102"},{"source":"pocgithub","id":"0x0d3ad/CVE-2024-34102","title":"0x0d3ad/CVE-2024-34102","date":"2024-06-30","url":"https://github.com/0x0d3ad/CVE-2024-34102"},{"source":"pocgithub","id":"jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento","title":"jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento","date":"2024-07-01","url":"https://github.com/jakabakos/CVE-2024-34102-CosmicSting-XXE-in-Adobe-Commerce-and-Magento"},{"source":"pocgithub","id":"SamJUK/cosmicsting-validator","title":"SamJUK/cosmicsting-validator","date":"2024-07-07","url":"https://github.com/SamJUK/cosmicsting-validator"},{"source":"pocgithub","id":"unknownzerobit/poc","title":"unknownzerobit/poc","date":"2024-07-08","url":"https://github.com/unknownzerobit/poc"},{"source":"pocgithub","id":"crynomore/CVE-2024-34102","title":"crynomore/CVE-2024-34102","date":"2024-07-11","url":"https://github.com/crynomore/CVE-2024-34102"},{"source":"pocgithub","id":"bughuntar/CVE-2024-34102","title":"bughuntar/CVE-2024-34102","date":"2024-07-13","url":"https://github.com/bughuntar/CVE-2024-34102"},{"source":"pocgithub","id":"Phantom-IN/CVE-2024-34102","title":"Phantom-IN/CVE-2024-34102","date":"2024-07-14","url":"https://github.com/Phantom-IN/CVE-2024-34102"},{"source":"metasploit","id":"exploit/linux/http/magento_xxe_to_glibc_buf_overflow","title":"CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)","type":"exploit","platform":"Linux,Unix","date":"2024-07-26","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/magento_xxe_to_glibc_buf_overflow"},{"source":"pocgithub","id":"wubinworks/magento2-cosmic-sting-patch","title":"wubinworks/magento2-cosmic-sting-patch","date":"2024-08-08","url":"https://github.com/wubinworks/magento2-cosmic-sting-patch"},{"source":"pocgithub","id":"EQSTLab/CVE-2024-34102","title":"EQSTLab/CVE-2024-34102","date":"2024-08-13","url":"https://github.com/EQSTLab/CVE-2024-34102"},{"source":"pocgithub","id":"dream434/CVE-2024-34102","title":"dream434/CVE-2024-34102","date":"2024-08-19","url":"https://github.com/dream434/CVE-2024-34102"},{"source":"pocgithub","id":"bka/magento-cve-2024-34102-exploit-cosmicstring","title":"bka/magento-cve-2024-34102-exploit-cosmicstring","date":"2024-10-08","url":"https://github.com/bka/magento-cve-2024-34102-exploit-cosmicstring"},{"source":"pocgithub","id":"wubinworks/magento2-encryption-key-manager-cli","title":"wubinworks/magento2-encryption-key-manager-cli","date":"2024-12-04","url":"https://github.com/wubinworks/magento2-encryption-key-manager-cli"},{"source":"pocgithub","id":"mksundaram69/CVE-2024-34102","title":"mksundaram69/CVE-2024-34102","date":"2025-01-07","url":"https://github.com/mksundaram69/CVE-2024-34102"},{"source":"pocgithub","id":"Koray123-debug/CVE-2024-34102","title":"Koray123-debug/CVE-2024-34102","date":"2025-04-06","url":"https://github.com/Koray123-debug/CVE-2024-34102"},{"source":"pocgithub","id":"Kento-Sec/CVE-2024-34102","title":"Kento-Sec/CVE-2024-34102","date":"2025-08-14","url":"https://github.com/Kento-Sec/CVE-2024-34102"},{"source":"pocgithub","id":"nmmorette/CVE-2024-34102","title":"nmmorette/CVE-2024-34102","date":"2026-02-13","url":"https://github.com/nmmorette/CVE-2024-34102"},{"source":"pocgithub","id":"russellwork2021-lgtm/cosmicsting-cve-2024-34102-exploit","title":"russellwork2021-lgtm/cosmicsting-cve-2024-34102-exploit","date":"2026-05-25","url":"https://github.com/russellwork2021-lgtm/cosmicsting-cve-2024-34102-exploit"},{"source":"pocgithub","id":"bigcartenergy/module-cosmicsting-patch","title":"bigcartenergy/module-cosmicsting-patch","date":"2026-11-07","url":"https://github.com/bigcartenergy/module-cosmicsting-patch"},{"source":"metasploit","id":"auxiliary/gather/magento_xxe_cve_2024_34102","title":"Magento XXE Unserialize Arbitrary File Read","type":"auxiliary","date":"2024-06-11","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/magento_xxe_cve_2024_34102"},{"source":"nuclei","id":"CVE-2024-34102","title":"Adobe Commerce \u0026 Magento - CosmicSting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-34102.yaml"}],"fixes":[{"ecosystem":"Packagist","package":"magento/community-edition","fixed_in":["2.4.6-p6","2.4.5-p8","2.4.4-p9"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"magento","fixed_in":["2.4.7-p1","2.4.6-p6","2.4.5-p8","2.4.4-p9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.4"},{"last_affected":"2.4.4"}]}],"versions":["2.4.4"]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.6-p1"},{"fixed":"2.4.6-p6"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5-p1"},{"fixed":"2.4.5-p8"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-p9"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5"},{"last_affected":"2.4.5"}]}],"versions":["2.4.5"]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.6"},{"last_affected":"2.4.6"}]}],"versions":["2.4.6"]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.7"},{"last_affected":"2.4.7"}]}],"versions":["2.4.7"]},{"source":"osv","ecosystem":"Bitnami","package":"magento","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.7-alpha0"},{"fixed":"2.4.7-p1"},{"introduced":"2.4.6-alpha0"},{"fixed":"2.4.6-p6"},{"introduced":"2.4.5-alpha0"},{"fixed":"2.4.5-p8"},{"introduced":"2.4.4-alpha0"},{"fixed":"2.4.4-p9"}]}]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","versions":["2.4.4"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.6-p1"},{"fixed":"2.4.6-p6"}]}],"versions":["2.4.6-p1","2.4.6-p2","2.4.6-p3","2.4.6-p4","2.4.6-p5"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5-p1"},{"fixed":"2.4.5-p8"}]}],"versions":["2.4.5-p1","2.4.5-p2","2.4.5-p3","2.4.5-p4","2.4.5-p5","2.4.5-p6","2.4.5-p7"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.4-p9"}]}],"versions":["0.1.0-alpha100","0.1.0-alpha101","0.1.0-alpha102","0.1.0-alpha103","0.1.0-alpha104","0.1.0-alpha105","0.1.0-alpha106","0.1.0-alpha107","0.1.0-alpha108","0.1.0-alpha89","0.1.0-alpha90","0.1.0-alpha91","0.1.0-alpha92","0.1.0-alpha93","0.1.0-alpha94","0.1.0-alpha95","0.1.0-alpha96","0.1.0-alpha97","0.1.0-alpha98","0.1.0-alpha99","0.42.0-beta1","0.42.0-beta10","0.42.0-beta11","0.42.0-beta2","0.42.0-beta3","0.42.0-beta4","0.42.0-beta5","0.42.0-beta6","0.42.0-beta7","0.42.0-beta8","0.42.0-beta9","0.74.0-beta1","0.74.0-beta10","0.74.0-beta11","0.74.0-beta12","0.74.0-beta13","0.74.0-beta14","0.74.0-beta15","0.74.0-beta16","0.74.0-beta2","0.74.0-beta3","0.74.0-beta4","0.74.0-beta5","0.74.0-beta6","0.74.0-beta7","0.74.0-beta8","0.74.0-beta9","1.0.0-beta","1.0.0-beta2","1.0.0-beta3","1.0.0-beta4","1.0.0-beta5","1.0.0-beta6","2.0.0","2.0.0-rc","2.0.0-rc2","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-rc1","2.1.0-rc2","2.1.0-rc3","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.18","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.2.10","2.2.11","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.1","2.3.2","2.3.2-p2","2.3.3","2.3.3-p1","2.3.4","2.3.4-p2","2.3.5","2.3.5-p1","2.3.5-p2","2.3.6","2.3.6-p1","2.3.7","2.3.7-p1","2.3.7-p2","2.3.7-p3","2.3.7-p4","2.4.0","2.4.0-p1","2.4.1","2.4.1-p1","2.4.2","2.4.2-p1","2.4.2-p2","2.4.3","2.4.3-p1","2.4.3-p2","2.4.3-p3","2.4.4","2.4.4-p1","2.4.4-p2","2.4.4-p3","2.4.4-p4","2.4.4-p5","2.4.4-p6","2.4.4-p7","2.4.4-p8"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","versions":["2.4.5"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","versions":["2.4.6"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","versions":["2.4.7"]}],"products":[{"vendor":"adobe","product":"adobe commerce"},{"vendor":"adobe","product":"commerce"},{"vendor":"adobe","product":"commerce and magento open source"},{"vendor":"adobe","product":"commerce_webhooks"},{"vendor":"adobe","product":"magento"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb24-40.html","tags":["vendor-advisory","x_transferred","Vendor Advisory","web","advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102","tags":["x_transferred","Exploit","Technical Description","Third Party Advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102","tags":["government-resource","Third Party Advisory","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34102","tags":["advisory"]},{"url":"https://github.com/magento/magento2/commit/30877fce83b793f71421c47347885cf076e81799","tags":["web"]},{"url":"https://github.com/magento/magento2/commit/a3c6d6e5e95e63031e4df26cfcf76feace7549c2","tags":["web"]},{"url":"https://github.com/magento/magento2/commit/c5c538810b87449886f4669cb8abbe8e5593c83c","tags":["web"]},{"url":"https://github.com/magento/magento2/commit/d10435b11ada4e502dca7539f8fd31d059d3c482#diff-84a0773a6287fbbaadf3b9103f4a137fc0b6946de2437ddfd6f60a0722cf8d23","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2024-34102.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m8cj-3v68-3cxj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34102.json","tags":["advisory"]},{"url":"https://github.com/magento/magento2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-34102","title":"XXE can expose crypt key and other secrets granting full admin access","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:04:56.093Z","modified":"2025-10-21T22:56:22.223Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:34:23.516065Z"}],"euvd":[{"id":"EUVD-2024-2102","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:04:56Z","modified":"2025-10-21T22:56:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-07-17","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-m8cj-3v68-3cxj","title":"Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:31:00Z","modified":"2024-07-17T19:15:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:56.530214Z"}],"kev":[{"id":"CVE-2024-34102","title":"Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability","description":"Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.","cwes":["CWE-611"],"kev":{"date_added":"2024-07-17","due_date":"2024-08-07","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-34102","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:15:10.38Z","modified":"2026-06-17T07:32:54.93Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:10:05.620461Z"}],"osv":[{"id":"CVE-2024-34102","title":"XXE can expose crypt key and other secrets granting full admin access","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:04:56.093Z","modified":"2026-10-28T02:31:01.315678782Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-m8cj-3v68-3cxj","title":"Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:31:00Z","modified":"2024-07-17T19:38:11.779047Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"BIT-magento-2024-34102","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-17T07:26:33.839Z","modified":"2024-07-18T07:56:34.499Z","updated_at":"2026-11-02T15:28:32.645004Z"}]}}