writeups.xyz / Why nested deserialization is harmful: Magento XXE (CVE-2024-34102)

Submitter : c2a

Date: 26 June 2024

Bounty : undisclosed

Vulnerabilities :

• Insecure Deserialization
• XXE
• Patch Diffing
• Security Code Review

Programs :

• Magento

Authors :

• Adam Kues (@Hash_kitten)
• Shubham Shah (@Infosec_au)

Link :
https://www.assetnote.io/resources/research/why-nested-deserialization-is-harmful-magento-xxe-cve-2024-34102