CVE-2024-34108: Large attack surface through legit webhook usage in Adobe Commerce

Q: What is the severity of CVE-2024-34108?

CVE-2024-34108 is classified as a critical severity vulnerability that allows arbitrary code execution.

Q: How do I fix CVE-2024-34108?

To fix CVE-2024-34108, upgrade your Adobe Commerce installation to versions 2.4.7 or later, or apply the latest patches available.

Q: Which versions are affected by CVE-2024-34108?

CVE-2024-34108 affects Adobe Commerce versions 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier, including version 2.3.7 and its patches.

Q: Does CVE-2024-34108 require user interaction to exploit?

No, exploitation of CVE-2024-34108 does not require user interaction.

Q: What type of vulnerability is CVE-2024-34108?

CVE-2024-34108 is an Improper Input Validation vulnerability.

Published Jun 13, 2024

Updated

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required and scope is changed.

Affected Software

71 affected components

Adobe Commerce=2.3.7

Adobe Commerce=2.3.7-p1

Adobe Commerce=2.3.7-p2

Adobe Commerce=2.3.7-p3

Adobe Commerce=2.3.7-p4

Adobe Commerce=2.3.7-p4-ext1

Adobe Commerce=2.3.7-p4-ext2

Adobe Commerce=2.3.7-p4-ext3

Adobe Commerce=2.3.7-p4-ext4

Adobe Commerce=2.4.0

Adobe Commerce=2.4.0-ext-1

Adobe Commerce=2.4.0-ext-2

Adobe Commerce=2.4.0-ext-3

Adobe Commerce=2.4.0-ext-4

Adobe Commerce=2.4.1

Adobe Commerce=2.4.1-ext-1

Adobe Commerce=2.4.1-ext-2

Adobe Commerce=2.4.1-ext-3

Adobe Commerce=2.4.1-ext-4

Adobe Commerce=2.4.2

Adobe Commerce=2.4.2-ext-1

Adobe Commerce=2.4.2-ext-2

Adobe Commerce=2.4.2-ext-3

Adobe Commerce=2.4.2-ext-4

Adobe Commerce=2.4.3

Adobe Commerce=2.4.3-ext-1

Adobe Commerce=2.4.3-ext-2

Adobe Commerce=2.4.3-ext-3

Adobe Commerce=2.4.3-ext-4

Adobe Commerce=2.4.4

Adobe Commerce=2.4.4-p1

Adobe Commerce=2.4.4-p2

Adobe Commerce=2.4.4-p3

Adobe Commerce=2.4.4-p4

Adobe Commerce=2.4.4-p5

Adobe Commerce=2.4.4-p6

Adobe Commerce=2.4.5

Adobe Commerce=2.4.5-p1

Adobe Commerce=2.4.5-p2

Adobe Commerce=2.4.5-p3

Adobe Commerce=2.4.5-p4

Adobe Commerce=2.4.5-p5

Adobe Commerce=2.4.6

Adobe Commerce=2.4.6-p1

Adobe Commerce=2.4.6-p2

Adobe Commerce=2.4.6-p3

Adobe Commerce Webhooks>=1.2.0<=1.4.0

Adobe Magento=2.4.4

Adobe Magento=2.4.4-p1

Adobe Magento=2.4.4-p2

Adobe Magento=2.4.4-p3

Adobe Magento=2.4.4-p4

Adobe Magento=2.4.4-p5

Adobe Magento=2.4.4-p6

Adobe Magento=2.4.4-p7

Adobe Magento=2.4.4-p8

Adobe Magento=2.4.5

Adobe Magento=2.4.5-p1

Adobe Magento=2.4.5-p2

Adobe Magento=2.4.5-p3

Adobe Magento=2.4.5-p4

Adobe Magento=2.4.5-p5

Adobe Magento=2.4.5-p6

Adobe Magento=2.4.5-p7

Adobe Magento=2.4.6

Adobe Magento=2.4.6-p1

Adobe Magento=2.4.6-p2

Adobe Magento=2.4.6-p3

Adobe Magento=2.4.6-p4

Adobe Magento=2.4.6-p5

Adobe Magento=2.4.7-b1

Event History

Jun 13, 2024

CVE Published

via MITRE·09:04 AM

Data Sourced

via MITRE·09:04 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:15 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2024-34108?

CVE-2024-34108 is classified as a critical severity vulnerability that allows arbitrary code execution.

How do I fix CVE-2024-34108?

To fix CVE-2024-34108, upgrade your Adobe Commerce installation to versions 2.4.7 or later, or apply the latest patches available.

Which versions are affected by CVE-2024-34108?

CVE-2024-34108 affects Adobe Commerce versions 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier, including version 2.3.7 and its patches.

Does CVE-2024-34108 require user interaction to exploit?

No, exploitation of CVE-2024-34108 does not require user interaction.

What type of vulnerability is CVE-2024-34108?