CVE-2024-34102Vulnerability
Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 20 months ago
CISA KEVAdded 17 Jul 2024
Fix due 7 Aug 2024
Used by ransomware: not knownCISA KEV catalogue
Fix due 7 Aug 2024
Used by ransomware: not knownCISA KEV catalogue
EPSS100.0%
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 21 Oct 2026
What the reports say
1 report, newest first · the exact sentence from each-
Fingerprint Heists: How your browser fingerprint can be stolen and used by fraudsters“…romised sites suggests that the threat actor is likely exploiting known vulnerabilities affecting vulnerable Magento versions (e.g., CVE-2024-34102 – CosmicSting, CVE-2024-20720).”
Indicators reported together
named in the same reports- hxxps://busz[.]io/j9z3GfPd?pr=1&sub_id_2=in 1 report
- busz[.]ioin 1 report
- hxxps://busz[.]io/clientsafe.jsin 1 report
- hxxps://customfingerprints.bablosoft[.]com/savein 1 report
- customfingerprints.bablosoft[.]comin 1 report
- browserleaks[.]comin 1 report
- hxxps://busz[.]io/j9z3GfPd?pr=1in 1 report
- hxxps://screamedjungle[.]com/mjzNTg?pr=1in 1 report
- screamedjungle[.]comin 1 report
- hxxps://screamedjungle[.]com/clientsafe.jsin 1 report
- dcc1122bcf60d91a…f4647b2daecain 1 report
Copy these 11 indicators · defanged
Also named with it: CVE-2024-20720
Thanks — we review every report.