Ecommerce sites across the world could be at risk from this dangerous security flaw, so patch now






A catastrophic vulnerability was recently discovered in Adobe Commerce and Magento, but ecommerce websites operating these platforms seem largely uninterested in applying a patch. As a result, “millions” of sites are open to attacks that could have devastating consequences, experts have warned.As reported by BleepingComputer, cybersecurity researchers from Sansec discovered an improper restriction of XML external entity reference (‘XXE’) vulnerability, and dubbed it “CosmicSting”. It is now being tracked as CVE-2024-34102, and carries a severity score of 9.8 (critical).Patch and mitigations”CosmicSting (aka CVE-2024-34102) is the worst bug to hit Magento and Adobe Commerce stores in two years,” Sansec said in a security advisory. “In itself, it allows anyone to read private files (such as those with passwords). However, combined with the recent iconv bug in Linux, it turns into the security nightmare of remote code execution.”Here are the product versions affected by CosmicSting:Adobe Commerce 2.4.7 and earlier, including 2.4.6-p5, 2.4.5-p7, 2.4.4-p8Adobe Commerce Extended Support 2.4.3-ext-7 and earlier, 2.4.2-ext-7 and earlier, 2.4.1-ext-7 and earlier, 2.4.0-ext-7 and earlier, 2.3.7-p4-ext-7 and earlier.Magento Open Source 2.4.7 and earlier, including 2.4.6-p5, 2.4.5-p7, 2.4.4-p8Adobe Commerce Webhooks Plugin versions 1.2.0 to 1.4.0If your business is running any of the above, make sure to apply the patch – which was already made available – as soon as possible.Sansec says that despite the vulnerability being made public more than a week ago, some 75% of Adobe Commerce and Magento users are yet to patch up. There is currently no evidence of in-the-wild abuse, and Adobe did not publish technical details so at to not give hackers any hints. However, Sansec says that the patch can be reverse-engineered and used to learn more about the bug. Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!Those who are unable to apply the patch immediately are advised to apply the mitigations found on this link. More from TechRadar Pro

Share this


Peloton headed to court over AI chat snooping complaint • The Register

Peloton is pedaling toward a court date after a California judge denied its bid to dismiss a lawsuit that alleges the pandemic darling violated...

Google Play Protect may get a more powerful local APK scanning

Google could boost Play Protect’s local app scanning capabilities soon. Now, the system would be more powerful and efficient thanks to the implementation of...

Recent articles

More like this


Please enter your comment!
Please enter your name here