CVE Vulnerability Advisory Database

Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.

Showing 1–1 of 1 advisories (Page 1/1)

CVE-2022-240869.8/CRITICALEPSS 99.2%CISA KEV

2022-02-16

Adobe Commerce and Magento Open Source Remote Code Execution (RCE) Vulnerability Advisory (CVE-2022-24086)

[Affected Scope] Adobe Commerce and Magento Open Source versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier)

[Impact] Unauthenticated attackers can exploit improper input validation during the checkout process to execute arbitrary code (RCE) without user interaction, potentially leading to full system compromise

[Mitigation] Immediately apply the official Adobe security patches (APSB22-12) and update Web Application Firewall (WAF) rules

CVE-2022-24086 RCE CWE-20 improper-input-validation checkout-process

Full Advisory & Mitigation