Adobe Commerce和Magento Open Source XML外部实体注入漏洞

详细信息

漏洞类型

通用型漏洞

漏洞描述

Adobe Commerce和Magento Open Source可允许远程攻击者在系统上执行任意代码，这是由于对XML外部实体(XXE)引用的限制不当所致。通过使用特制的XML内容，远程攻击者可利用此漏洞在系统上执行任意代码或造成拒绝服务。

修复建议

有关修补程序、升级或建议的解决方法信息，请参阅Adobe Security Bulletin APSB24-40。参考链接： https://helpx.adobe.com/security/products/magento/apsb24-40.html

参考链接

• https://github.com/advisories/GHSA-m8cj-3v68-3cxj

  GitHub

• https://github.com/magento/magento2/commit/30877fce83b793f71421c47347885cf076e81799

  GitHub

• https://github.com/magento/magento2/commit/a3c6d6e5e95e63031e4df26cfcf76feace7549c2

  GitHub

• https://github.com/magento/magento2/commit/c5c538810b87449886f4669cb8abbe8e5593c83c

  GitHub

• https://github.com/magento/magento2/commit/d10435b11ada4e502dca7539f8fd31d059d3c482#diff-84a0773a6287fbbaadf3b9103f4a137fc0b6946de2437ddfd6f60a0722cf8d23

  GitHub

• https://helpx.adobe.com/security/products/magento/apsb24-40.html

  CVE · vendor-advisory

• https://nvd.nist.gov/vuln/detail/CVE-2024-34102

  GitHub

• https://www.vicarius.io/vsociety/posts/cosmicsting-critical-unauthenticated-xxe-vulnerability-in-adobe-commerce-and-magento-cve-2024-34102

  CVE · Third Party Advisory · Exploit · Technical Description

• https://osv.dev/vulnerability/BIT-magento-2024-34102

  OSV

• https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2024-34102.yaml

  OSV

• https://github.com/magento/magento2

  OSV

• https://osv.dev/vulnerability/GHSA-m8cj-3v68-3cxj

  OSV

• https://osv.dev/vulnerability/CVE-2024-34102

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-34102

  NVD · US Government Resource · Third Party Advisory