high7.5
CVE-2025-22387
An issue was discovered in Optimizely Configured Commerce before 5.2.2408.
Impact
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Optimizely | Configured Commerce | before 5.2.2408 |