CVE-2022-24086

Adobe Commerce and Magento Open Source: Improper Input Validation

As of , CVE-2022-24086 in Adobe Commerce and Magento Open Source is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 15 February 2022
US federal deadline
1 March 202214 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
No score that dayThe EPSS file of the day CISA listed it has no score for it.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.

CISA's description

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

The CVE record's description, from adobe

CVE published
16 February 2022
Assigned by
adobe
CVSS
9.8 Critical (CVSS 3.1, from the CNA)
CWE-20
Improper Input Validation
CISA SSVC, exploitation
active
CISA SSVC, automatable
yes
CISA SSVC, technical impact
total

Timeline

  1. CISA added it to its list of exploited vulnerabilities.
  2. The CVE record was published.
  3. The US federal deadline to fix it.

Commerce and Magento Open Source: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2024-34102Improper Restriction of XML External Entity Reference (XXE)Adobe Commerce and Magento Open SourcePatch this weekMetasploit module; EPSS 0.990.99

Read further