CVE-2022-24086

CRITICALCISA KEV

9.8

Description

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published2/16/2022

Last Modified10/23/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorAdobe

ProductCommerce and Magento Open Source

Vulnerability NameAdobe Commerce and Magento Open Source Improper Input Validation Vulnerability

KEV Date Added2022-02-15

Remediation Due Date2022-03-01

Ransomware UseUnknown

Affected Products

adobe:commerceadobe:magento

Weaknesses (CWE)

CWE-20

References

https://helpx.adobe.com/security/products/magento/apsb22-12.html(psirt@adobe.com)

https://helpx.adobe.com/security/products/magento/apsb22-12.html(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.