~ / search / GHSA-m8cj-3v68-3cxj

GHSA-m8cj-3v68-3cxj

Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-34102

Packages

EcosystemPackageAffectedFixed in
Packagist magento/community-edition 2.4.4 no fix listed
Packagist magento/community-edition >= 2.4.6-p1, < 2.4.6-p6 2.4.6-p6
Packagist magento/community-edition >= 2.4.5-p1, < 2.4.5-p8 2.4.5-p8
Packagist magento/community-edition < 2.4.4-p9 2.4.4-p9
Packagist magento/community-edition 2.4.5 no fix listed
Packagist magento/community-edition 2.4.6 no fix listed
Packagist magento/community-edition 2.4.7 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

References

External links from the advisory. They lead to third-party sites.