by Kastro
Paper/Archive/CVE-2022-24086

CVE-2022-24086

Adobe Magento Commerce — Adobe Commerce checkout improper input validation leads to remote code execution

KEV · due 1 MarEPSS 99%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Affected

ProductAffectedFixed inSource
Magento Commerceunspecified – 2.4.3-p1–CNA
Magento Commerceunspecified – 2.3.7-p2–CNA
Magento Commerceunspecified – None–CNA

Scores by source

adobe (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refhelpx.adobe.com/security/products/magento/apsb22-12.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086kevcisa.gov/known-exploited-vulnerabilities-catalog