CVE-2024-34102: Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
Published Jun 13, 2024 · Updated Jul 17, 2024
Affected packages
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- = 2.4.4
- Fixed in
- No patched version yet
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.4.6-p1, < 2.4.6-p6
- Fixed in
- 2.4.6-p6
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.4.5-p1, < 2.4.5-p8
- Fixed in
- 2.4.5-p8
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- < 2.4.4-p9
- Fixed in
- 2.4.4-p9
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- = 2.4.5
- Fixed in
- No patched version yet
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- = 2.4.6
- Fixed in
- No patched version yet
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- = 2.4.7
- Fixed in
- No patched version yet
- Check
composer show magento/community-edition
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-34102
- https://helpx.adobe.com/security/products/magento/apsb24-40.html
- https://github.com/magento/magento2/commit/30877fce83b793f71421c47347885cf076e81799
- https://github.com/magento/magento2/commit/a3c6d6e5e95e63031e4df26cfcf76feace7549c2
- https://github.com/magento/magento2/commit/c5c538810b87449886f4669cb8abbe8e5593c83c
- https://github.com/magento/magento2/commit/d10435b11ada4e502dca7539f8fd31d059d3c482#diff-84a0773a6287fbbaadf3b9103f4a137fc0b6946de2437ddfd6f60a0722cf8d23
- https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2024-34102.yaml
- https://github.com/advisories/GHSA-m8cj-3v68-3cxj
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Composer (PHP) vulnerabilities
All Composer (PHP) entriesCVE-2025-54236
Magento Community Edition Improper Input Validation vulnerability
critical9.1ExploitedNo fixSep 9, 2025CVE-2025-47110
Magneto contains stored XSS vulnerability
critical9.1No fixJun 10, 2025CVE-2025-24434
Improper Authorization vulnerability in Magento and Adobe Commerce
critical9.1No fixFeb 11, 2025CVE-2024-34103
Magento Open Source Improper Authentication vulnerability
critical8.1No fixJun 13, 2024GHSA-26hq-7286-mg8f
Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
criticalMay 15, 2024GHSA-5gmh-85x8-5cx7
Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
criticalMay 15, 2024