Critical XXE Vulnerability Discovered in Adobe Commerce and Magento Open Source

What changed

Adobe has reported a significant vulnerability affecting multiple versions of Adobe Commerce and Magento Open Source. This flaw involves improper restriction of XML External Entity references, which could lead to arbitrary code execution if exploited.

The affected versions include Adobe Commerce 2.4.7, 2.4.6-p5, 2.4.5-p7, and 2.4.4-p8 and earlier. Attackers can exploit this vulnerability by sending a specially crafted XML document that references external entities, and notably, this does not require any user interaction.

Who is affected

Organizations using Adobe Commerce and Magento Open Source should be aware of their exposure to this vulnerability. It is critical for users to assess their systems and take appropriate measures to mitigate risks.

The following groups are particularly at risk:

• Users of Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, and 2.4.4-p8 and earlier.
• Businesses relying on Magento Open Source for e-commerce solutions.
• Developers and system administrators managing these platforms.
• Any organization that processes sensitive data through these systems.

What to do

It is imperative for affected users to take immediate action to protect their systems from potential exploitation. Adobe has likely released patches or updates to address this vulnerability.

Follow these steps to mitigate the risk:

• Review and apply any security updates provided by Adobe.
• Audit your systems to identify any vulnerable versions of Adobe Commerce or Magento Open Source.
• Implement additional security measures, such as input validation and monitoring for unusual activity.
• Stay informed about further updates or advisories from Adobe regarding this vulnerability.