CVE-2022-24086

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 99,2%

Kerentanan Improper Input Validation pada adobe commerce, adobe magento. Skor CVSS 3.1 9.8 (Critical) menurut adobe.com. Masuk katalog KEV CISA pada 15 Februari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Rincian

Terbit di NVD

16 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber adobe.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

99,2% peluang dieksploitasi; lebih tinggi dari 99,9% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability

Masuk KEV

15 Februari 2022

Tenggat CISA

1 Maret 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://helpx.adobe.com/security/products/magento/apsb22-12.html patch · release notes · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086 advisory pihak ketiga · pemerintah AS