APSB24-40: Security update available for Adobe Commerce

APSB24-40 (published 2024-06-11) fixes 1 CVE in Adobe Commerce and Magento Open Source 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier; fixed in 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9; isolated patch CVE-2024-34102.

XML external entity injection in the REST API (CVE-2024-34102), publicly known as CosmicSting. An unauthenticated attacker can read arbitrary files such as env.php and, chained with the glibc iconv bug CVE-2024-2961, execute code. Mass exploitation followed within weeks; Adobe also released an isolated patch for stores that could not upgrade.

Published

Jun 11, 2024

Severity

critical

CVEs

1

Isolated patch

yes

CVEs

Fixed in

Magento Open Source

2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9

Adobe Commerce

2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9

Mage-OS

—

Isolated patches

• CVE-2024-34102 isolated patch — applies to 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8

References

• https://helpx.adobe.com/security/products/magento/apsb24-40.html

For integrators

Get this bulletin as JSON:

curl -s https://magento.watch/api/v1/security-bulletins/APSB24-40