10

CVE-2022-24086

Warnung

Adobe Commerce checkout improper input validation leads to remote code execution

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Commerce Version < 2.3.0
Adobe ≫ Commerce Version >= 2.3.3 <= 2.3.6
Adobe ≫ Commerce Version >= 2.4.0 <= 2.4.2
Adobe ≫ Commerce Version 2.3.7 Update p1
Adobe ≫ Commerce Version 2.3.7 Update p2
Adobe ≫ Commerce Version 2.4.3 Update -
Adobe ≫ Commerce Version 2.4.3 Update p1
Adobe ≫ Magento SwEdition open_source Version < 2.3.0
Adobe ≫ Magento SwEdition open_source Version > 2.3.3 <= 2.3.6
Adobe ≫ Magento SwEdition open_source Version >= 2.4.0 <= 2.4.2
Adobe ≫ Magento Version 2.3.7 Update p1 SwEdition open_source
Adobe ≫ Magento Version 2.3.7 Update p2 SwEdition open_source
Adobe ≫ Magento Version 2.4.3 Update - SwEdition open_source
Adobe ≫ Magento Version 2.4.3 Update p1 SwEdition open_source

15.02.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Schwachstelle

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 99.11% 0.999
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
Adobe 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://helpx.adobe.com/security/products/magento/apsb22-12.html
Patch
Vendor Advisory
Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086
Third Party Advisory
US Government Resource