CVE-2025-54236

Katalog CVE

CVSS 9.1 · Critical KEV · sudah dieksploitasi EPSS 94,5%

Kerentanan Improper Input Validation pada adobe commerce. Skor CVSS 3.1 9.1 (Critical) menurut adobe.com. Masuk katalog KEV CISA pada 24 Oktober 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

Rincian

Terbit di NVD

9 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber adobe.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

94,5% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Adobe Commerce and Magento Improper Input Validation Vulnerability

Masuk KEV

24 Oktober 2025

Tenggat CISA

14 November 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 152 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://helpx.adobe.com/security/products/magento/apsb25-88.html advisory vendor
• https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236 pemerintah AS
• https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento broken link · exploit · advisory pihak ketiga