CVE-2022-24093: Magento Open Source affected by Improper Input Validation
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.
Other sources
Magento Open Source affected by Improper Input Validation
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.7-p3 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.3-p2
Event History
Frequently Asked Questions
What is the vulnerability ID for this Adobe Commerce vulnerability?
The vulnerability ID for this Adobe Commerce vulnerability is CVE-2022-24093.
What versions of Adobe Commerce are affected by this vulnerability?
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by this vulnerability.
What is the severity of CVE-2022-24093?
CVE-2022-24093 has a severity rating of 7.2 (critical).
How does the vulnerability in Adobe Commerce affect the system?
The vulnerability in Adobe Commerce allows for an improper input validation vulnerability, which could result in a post-authentication arbitrary code execution.
Is user interaction required to exploit this vulnerability?
No, exploitation of this vulnerability does not require user interaction.
How can I fix this vulnerability in Adobe Commerce?
To fix this vulnerability in Adobe Commerce, update to versions 2.4.3-p2, 2.3.8-p1, or later.
Where can I find more information about this Adobe Commerce vulnerability?
You can find more information about this Adobe Commerce vulnerability on Adobe's website.