جزئیات آسیبپذیری
CVE-2024-34102
بهرهبرداری فعال
Adobe CommerceAdobe commerce
XXE can expose crypt key and other secrets granting full admin access
CVSS 3.1
9.8بحرانی
شرح رسمی (انگلیسی)
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 9.8بحرانی | 3.1 | CVEProject cvelistV5 (CNA) (adobe) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیبپذیر
| فروشنده | محصول | نسخهها | منبع |
|---|---|---|---|
| Adobe | Adobe Commerce | v ≤ 2.4.4-p8 | CVEProject cvelistV5 (CNA) |
| Adobe | commerce | v ≤ 2.4.7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.6-p5 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.5-p7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.4-p8 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.3-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.2-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.1-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.0-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.3.7-p4-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.6-p5 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.5-p7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.4-p8 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.3-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.2-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.1-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.0-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.3.7-p4-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.6-p5 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.5-p7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.4-p8 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.3-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.2-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.1-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.0-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.3.7-p4-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.6-p5 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.5-p7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.4-p8 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.3-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.2-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.1-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.0-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.3.7-p4-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.6-p5 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.5-p7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.4-p8 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.3-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.2-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.1-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.0-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.3.7-p4-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.6-p5 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.5-p7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.4-p8 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.3-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.2-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.1-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.0-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.3.7-p4-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.6-p5 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.5-p7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.4-p8 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.3-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.2-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.1-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.0-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.3.7-p4-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.6-p5 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.5-p7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.4-p8 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.3-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.2-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.1-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.0-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.3.7-p4-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.6-p5 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.5-p7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.4-p8 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.3-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.2-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.1-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.4.0-ext-7 | CISA ADP / Vulnrichment |
| Adobe | commerce | v ≤ 2.3.7-p4-ext-7 | CISA ADP / Vulnrichment |
منابع و راهنماها
۳- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102 government-resource
- https://helpx.adobe.com/security/products/magento/apsb24-40.html vendor-advisory
- https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیبپذیریهای تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۳/۰۳/۲۴
- آخرین بهروزرسانی
- ۱۴۰۴/۰۷/۳۰
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- adobe
فهرست KEV آژانس CISA
- تاریخ افزودهشدن
- ۱۴۰۳/۰۴/۲۷
- مهلت رفع
- ۱۴۰۳/۰۵/۱۷
- استفاده در باجافزار
- نامشخص
پیشبینی بهرهبرداری (EPSS)
۹۹٫۹۹٪
احتمال بهرهبرداری در ۳۰ روز
۹۹٫۹٪
صدک (نسبت به همهی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- بله
- وضعیت بهرهبرداری
- فعال
- اثر فنی
- کامل
ضعفها (CWE)
- CWE-611Improper Restriction of XML External Entity Reference ('XXE') (CWE-611)