We would like to bring your attention to the following 0-day exploit we have recently become aware of.
A zero day remote code-execution (RCE) bug in the Magento 2 and Adobe Commerce platforms has been discovered. This vulnerability has been seen to be actively exploited in the wild.
Affected Versions (Both eCommerce Platforms)
-
2.3.7-p2 and earlier
-
2.4.3-p1 and earlier
This vulnerability has been rated as 9.8 out of 10 on the CVSS vulnerability scale. The vulnerability is triggered by improper input validation during the checkout process.
To exploit the vulnerability in its present form, an attacker would need to have administrative privileges in order to be successful.
Remediation
Patches have been made available from Adobe Directly.
-
If you are running Magento 2.3 or 2.4, install the custom patch from Adobe.
-
If you are running a version of Magento 2 between 2.3.3 and 2.3.7, you should be able to manually apply the patch.
Versions of Magento 2.3.3 or below, are not directly vulnerable. However, it is advisable to apply this patch to ensure any future weaknesses identified are mitigated.
References:
![](https://www.covertswarm.com/wp-content/uploads/2024/06/2024-Academy-Intake-3-640x320.png)
Academy Launches Second Intake
CovertSwarm’s Academy is opening the 2024 intake. Apply and start your cybersecurity journey as an ethical hacker.
![DORA & NIS2 European Flag](https://www.covertswarm.com/wp-content/uploads/2024/05/DORA-and-NIS2-European-Flag-640x320.png)
Combining regulation with real-world security assurance: DORA and NIS2
Whether you’re a local financial startup or a multinational food distributor, understanding how DORA and NIS2 may affect your organization is vital. With implementation dates just…
![](https://www.covertswarm.com/wp-content/uploads/2024/05/Clutch-100-fastest-growth-640x320.png)
CovertSwarm named by Clutch among Top 100 Fastest-Growing Companies
Clutch has recognized us for achieving one of the highest revenue growth rates from 2022 to 2023.