Input validation error in Magento Open Source and Adobe Commerce (formerly Magento Commerce) - CVE-2024-34109

Vulnerability identifier: #VU94046

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-34109

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to insufficient validation of user-supplied input. A remote privileged user can send specially crafted input to the application and execute arbitrary code.

Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install updates from vendor's website.

Magento Open Source - addressed in versions 2.4.4-p9, 2.4.5-p8, 2.4.6-p6, 2.4.7-p1
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.3.7-p4-ext-8, 2.4.0-ext-8, 2.4.1-ext-8, 2.4.2-ext-8, 2.4.3-ext-8, 2.4.4-p9, 2.4.5-p8, 2.4.6-p6, 2.4.7-p1

• https://helpx.adobe.com/security/products/magento/apsb24-40.html

• Multiple vulnerabilities in Adobe Commerce and Magento Open Source