CVE-2024-34109 Adobe Commerce | Improper Input Validation (CWE-20)

High 7.2 Published 13 Jun 2024 Updated 17 Sep 2024

An attacker with admin privileges can execute arbitrary code due to improper input validation in Adobe Commerce.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-34109?

CVE-2024-34109 is a high-severity code injection vulnerability in Adobe Commerce, published on 13 Jun 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required.

Weakness: CWE-20

Which versions are affected by CVE-2024-34109?

1 open source package ship an affected version, including magento. It affects 3 products.

Package	Affected	Fixed in
`magento` Bitnami	From `2.4.7-alpha0`	`2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9`

Products include Adobe Commerce, Adobe Commerce Webhooks, Adobe Magento.

How do I fix CVE-2024-34109?

Upgrade magento to a fixed version for your release line: 2.4.7-p1, 2.4.6-p6, 2.4.5-p8 or 2.4.4-p9.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-34109 being exploited?

There is no known exploitation of CVE-2024-34109 in the wild and no public exploit code.

All Adobe Commerce vulnerabilities

Sources

Also known as BIT-magento-2024-34109, GHSA-h44r-7f3w-cmm3.