Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
Metrics
Affected Vendors & Products
References
History
Tue, 21 Oct 2025 23:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 21 Oct 2025 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 21 Oct 2025 19:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 16 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Tue, 15 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Thu, 13 Feb 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:adobe:commerce:-:*:*:*:*:*:*:* | |
| Metrics |
kev
|
Fri, 29 Nov 2024 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.3.7:p3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.3.7:p4-ext1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.3.7:p4-ext2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.3.7:p4-ext3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.3.7:p4-ext4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.3.7:p4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.0:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.0:ext-1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.0:ext-2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.0:ext-3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.0:ext-4:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.1:-:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.1:ext-1:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.1:ext-2:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.1:ext-3:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.1:ext-4:*:*:*:*:*:* |
cpe:2.3:a:adobe:commerce:2.4.2:ext-7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.3:ext-7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.4:p8:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.5:p7:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.6:p5:*:*:*:*:*:* cpe:2.3:a:adobe:commerce:2.4.7:-:*:*:*:*:*:* cpe:2.3:a:adobe:magento:2.4.7:-:*:*:open_source:*:*:* |
Status: PUBLISHED
Assigner: adobe
Published: 2024-06-13T09:04:56.093Z
Updated: 2025-10-21T22:56:22.223Z
Reserved: 2024-04-30T19:50:50.900Z
Link: CVE-2024-34102
Updated: 2024-08-02T02:42:59.911Z
Status : Analyzed
Published: 2024-06-13T09:15:10.380
Modified: 2025-10-23T14:51:28.030
Link: CVE-2024-34102
No data.