CVE-2022-24086criticalunder attackCWE-20

CVE-2022-24086: critical vulnerability in Adobe Magento Commerce

Adobe Commerce checkout improper input validation leads to remote code execution

Published · Updated

Follow this CVE+ Monitor Adobe Commerce+ Monitor Magento Commerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weapon4 days
Published on NVDFeb 16
1st PoC+4d
CISA KEVFeb 15
Action required by CISAfederal deadline: 2022-03-01

Apply updates per vendor instructions.

In short

Adobe Commerce has a flaw in its checkout system that fails to properly check user input, allowing attackers to run harmful code without needing to interact with users. This is a critical weakness that puts online stores at serious risk.

Technical detail

Improper input validation in Adobe Commerce checkout (CWE-20) allows unauthenticated remote code execution without user interaction. The vulnerability affects versions 2.4.3-p1 and earlier, 2.3.7-p2 and earlier; attackers can exploit malformed checkout parameters to achieve arbitrary code execution on the server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Adobe · Magento Commerce
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Adobe Magento Commerce

In the same product, most dangerous first.

CVE-2021-21029MEDIUMMagento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript ExecutionEPSS 85.2%CVE-2022-34258MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 69.9%CVE-2023-22249MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 58.5%CVE-2022-35698CRITICALAdobe Commerce Stored XSS Arbitrary code executionEPSS 14.7%CVE-2021-21064MEDIUMMagento UPWARD-php Path traversal vulnerability via UPWARD ConnectorEPSS 8.5%CVE-2021-21030HIGHMagento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript ExecutionEPSS 5.7%