Adobe Commerce checkout improper input validation leads to remote code execution (Adobe Magento Commerce)
At a glance
- Source
- NVD
- EPSS
- EPSS 99.20 % · percentile 100 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Analyzed
Description
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
Weaknesses (CWE)
- CWE-20 — Improper Input Validation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | adobe |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · psirt@adobe.com (Secondary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-f8fv-f786-9933 — Magento improper input validation vulnerability
European references
- ENISA EUVD · EUVD-2022-0975
- GCVE · GCVE-0-2022-24086
CERT-FR advisories
- CERTFR-2022-AVI-167 — Multiples vulnérabilités dans Adobe Commerce · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*< 2.3.0cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*≥ 2.3.3 ≤ 2.3.6cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*< 2.3.0cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*> 2.3.3 ≤ 2.3.6cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:adobe:magento:2.3.7:p1:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.3.7:p2:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.3:-:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.3:p1:*:*:open_source:*:*:*
Affected products
| Product | Versions |
|---|---|
| Adobe · Magento Commerce | affected unspecified ≤ 2.4.3-p1 ; affected unspecified ≤ 2.3.7-p2 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |