This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.MAGENTO_XXE_CVE-2024-34102.NBINMagento XXE (CVE-2024-34102)
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
The Magento application running on the remote web server is affected by an XML external entity injection (XXE) vulnerability due to improper parsing of XML data with nested deserialization. A remote, unauthenticated attacker can exploit this vulnerability, via HTTP, to execute arbitrary code on the remote host.
Binary data magento_XXE_CVE-2024-34102.nbinRelated
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low