IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
9.8Crítica KEV

CVE-2022-24086Adobe Commerce checkout improper input validation leads to remote code execution

Adobe Magento Commerce Publicada: (hace 4 años)

Explotación conocida — Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

CISA confirmó el 15.02.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 01.03.2022.

Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2022-24086

Descripción

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Debilidad (CWE): CWE-20

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
adobe commerce < 2.3.0
adobe magento < 2.3.0
Adobe Magento Commerce unspecified – ≤ 2.4.3-p1, unspecified – ≤ 2.3.7-p2, unspecified – ≤ None

Referencias y parches

Coincidencias CPE (NVD) (14)
  • cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* < 2.3.0
  • cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* ≥ 2.3.3 ≤ 2.3.6
  • cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:* ≥ 2.4.0 ≤ 2.4.2
  • cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*
  • cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*
  • cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:* < 2.3.0
  • cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:* ≥ 2.3.3 ≤ 2.3.6
  • cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:* ≥ 2.4.0 ≤ 2.4.2
  • cpe:2.3:a:adobe:magento:2.3.7:p1:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.3.7:p2:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.3:-:*:*:open_source:*:*:*
  • cpe:2.3:a:adobe:magento:2.4.3:p1:*:*:open_source:*:*:*

CVE recientes del mismo producto — Adobe Commerce / Magento

8.7Alta
CVE-2026-95631

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitatio…

7.2Alta
CVE-2026-92910

Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation …

9.3Crítica
CVE-2026-91013

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the pag…

9.1Crítica
CVE-2026-92464

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitatio…

4.3Media
CVE-2026-95630

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Adobe Commerce; Adobe Adobe Commerce B2B; Adobe Magento Open Source

Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of…