critical9.8Known exploited
CVE-2022-24086
Magento improper input validation vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-02-15. Federal due date: 2022-03-01.
Apply updates per vendor instructions.
Impact
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | magento/community-edition | >= 2.3.3-p1, < 2.3.7-p3 | 2.3.7-p3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Adobe | Commerce | before 2.3.0 from 2.3.3 through 2.3.6 from 2.4.0 through 2.4.2 Versions 2.3.7, 2.4.3 |
| Adobe | Magento | before 2.3.0 after 2.3.3 through 2.3.6 from 2.4.0 through 2.4.2 Versions 2.3.7, 2.4.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- CISA KEV catalog
- https://helpx.adobe.com/security/products/magento/apsb22-12.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086
- https://github.com/advisories/GHSA-f8fv-f786-9933
- https://nvd.nist.gov/vuln/detail/CVE-2022-24086