7.2

CVE-2022-24093

Adobe Commerce post-auth improper input validation leads to remote code execution

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Magento Open Source Version < 2.3.7
Adobe ≫ Magento Open Source Version >= 2.4.0 < 2.4.3
Adobe ≫ Magento Open Source Version 2.3.7 Update p1
Adobe ≫ Magento Open Source Version 2.3.7 Update p2
Adobe ≫ Magento Open Source Version 2.4.3 Update -
Adobe ≫ Magento Open Source Version 2.4.3 Update p1
Adobe ≫ Commerce Version < 2.3.7
Adobe ≫ Commerce Version >= 2.4.0 < 2.4.3
Adobe ≫ Commerce Version 2.3.7 Update p1
Adobe ≫ Commerce Version 2.3.7 Update p2
Adobe ≫ Commerce Version 2.4.3 Update -
Adobe ≫ Commerce Version 2.4.3 Update p1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.46% 0.702
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Adobe 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://helpx.adobe.com/security/products/magento/apsb22-13.html
Patch
Vendor Advisory