Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability

2024-06-1309:31:00

CWE-611

GitHub Advisory Database

github.com

magento

xxe

xml

adobe commerce

vulnerability

arbitrary code execution

software

security

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.4

Confidence

High

EPSS

0.973

Percentile

99.9%

JSON

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference (‘XXE’) vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.

Affected configurations

Vulners

Node

magentocommunity-editionMatch2.4.7

magentocommunity-editionMatch2.4.6

magentocommunity-editionMatch2.4.5

magentocommunity-editionRange<2.4.4-p9

magentocommunity-editionRange2.4.5-p1–2.4.5-p8

magentocommunity-editionRange2.4.6-p1–2.4.6-p6

magentocommunity-editionMatch2.4.4

VendorProductVersionCPE
magentocommunity-edition2.4.7cpe:2.3:a:magento:community-edition:2.4.7:*:*:*:*:*:*:*
magentocommunity-edition2.4.6cpe:2.3:a:magento:community-edition:2.4.6:*:*:*:*:*:*:*
magentocommunity-edition2.4.5cpe:2.3:a:magento:community-edition:2.4.5:*:*:*:*:*:*:*
magentocommunity-edition*cpe:2.3:a:magento:community-edition:*:*:*:*:*:*:*:*
magentocommunity-edition2.4.4cpe:2.3:a:magento:community-edition:2.4.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
magento	community-edition	2.4.7	cpe:2.3:a:magento:community-edition:2.4.7:::::::*
magento	community-edition	2.4.6	cpe:2.3:a:magento:community-edition:2.4.6:::::::*
magento	community-edition	2.4.5	cpe:2.3:a:magento:community-edition:2.4.5:::::::*
magento	community-edition	*	cpe:2.3:a:magento:community-edition::::::::
magento	community-edition	2.4.4	cpe:2.3:a:magento:community-edition:2.4.4:::::::*