{"id":"CVE-2024-34110","aliases":["BIT-magento-2024-34110","EUVD-2024-34633","GHSA-x6mf-qhjj-pcj9"],"status":"published","title":"RCE in the Adobe Commerce Webhook module through a legit webhook definition","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01386,"percentile":0.7243,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434"],"published":"2024-06-13T09:04:59Z","modified":"2026-10-28T02:31:11Z","fixes":[{"ecosystem":"Bitnami","package":"magento","fixed_in":["2.4.7-p1","2.4.6-p6","2.4.5-p8","2.4.4-p9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"magento","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.7-alpha0"},{"fixed":"2.4.7-p1"},{"introduced":"2.4.6-alpha0"},{"fixed":"2.4.6-p6"},{"introduced":"2.4.5-alpha0"},{"fixed":"2.4.5-p8"},{"introduced":"2.4.4-alpha0"},{"fixed":"2.4.4-p9"}]}]}],"products":[{"vendor":"adobe","product":"adobe commerce"},{"vendor":"adobe","product":"commerce"},{"vendor":"adobe","product":"commerce_webhooks"},{"vendor":"adobe","product":"magento"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb24-40.html","tags":["vendor-advisory","x_transferred","Vendor Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34110","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x6mf-qhjj-pcj9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34110.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-34110","title":"RCE in the Adobe Commerce Webhook module through a legit webhook definition","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:04:59.918Z","modified":"2024-08-02T02:43:00.355Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:34:23.193864Z"}],"euvd":[{"id":"EUVD-2024-34633","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:04:59Z","modified":"2024-08-02T02:43:00Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:21.347751Z"}],"ghsa":[{"id":"GHSA-x6mf-qhjj-pcj9","title":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an...","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:31:01Z","modified":"2024-06-13T09:31:09Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:57:29.280985Z"}],"nvd":[{"id":"CVE-2024-34110","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:15:13.137Z","modified":"2026-06-17T07:32:56.043Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:10:05.620461Z"}],"osv":[{"id":"CVE-2024-34110","title":"RCE in the Adobe Commerce Webhook module through a legit webhook definition","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-13T09:04:59.918Z","modified":"2026-10-28T02:31:11.666936817Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"BIT-magento-2024-34110","description":"Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution. A high-privilege attacker could exploit this vulnerability by uploading a malicious file to the system, which could then be executed. Exploitation of this issue does not require user interaction.","status":"published","published":"2024-06-17T07:24:19.933Z","modified":"2024-07-18T07:56:34.499Z","updated_at":"2026-11-02T15:28:32.645004Z"}]}}