Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 17/07/2024. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| magento/community-edition | = 2.4.4= 2.4.5= 2.4.6= 2.4.7≥ 2.4.5-p1, < 2.4.5-p8≥ 2.4.6-p1, < 2.4.6-p6< 2.4.4-p9 | 2.4.5-p82.4.6-p62.4.4-p9 |
| commerce | = 2.4.2= 2.4.3= 2.4.4= 2.4.5= 2.4.6= 2.4.7 | |
| commerce webhooks | ≥ 1.2.0, < 1.5.0 | 1.5.0 |
| magento | = 2.4.4= 2.4.5= 2.4.6= 2.4.7 |
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free