July 17, 2024 · Applied Cybernetics Group
CVE-2024-34102 — Adobe Commerce and Magento Open Source
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
- Added to KEV
2024-07-17- Federal due date
2024-08-07- Vendor
- Adobe
- Product
- Commerce and Magento Open Source
- EPSS
- 100.0th percentile (score 1.000, as of
2026-07-13) - NVD CVSS v3.1
- —
- Ransomware use
- Unknown
- ATT&CK
- T1005 , T1059 , T1190 · signal rollup
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2024-34102
CISA short description
Adobe Commerce and Magento Open Source contain an improper restriction of XML external entity reference (XXE) vulnerability that allows for remote code execution.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.