CVE-2022-24093: Adobe Commerce post-auth improper input validation leads to remote code execution
First published: Tue Sep 12 2023(Updated: )
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Magento | <2.3.7 | |
| Adobe Magento | >=2.4.0<2.4.3 | |
| Adobe Magento | =2.3.7-p1 | |
| Adobe Magento | =2.3.7-p2 | |
| Adobe Magento | =2.4.3 | |
| Adobe Magento | =2.4.3-p1 | |
| Adobe Magento Commerce | <2.3.7 | |
| Adobe Magento Commerce | >=2.4.0<2.4.3 | |
| Adobe Magento Commerce | =2.3.7-p1 | |
| Adobe Magento Commerce | =2.3.7-p2 | |
| Adobe Magento Commerce | =2.4.3 | |
| Adobe Magento Commerce | =2.4.3-p1 | |
| composer/magento/project-community-edition | <=2.0.2 | |
| composer/magento/community-edition | >=2.3.7-p1<2.3.7-p3 | 2.3.7-p3 |
| composer/magento/community-edition | =2.4.3-p1 | 2.4.3-p2 |
| composer/magento/community-edition | =2.3.7 | |
| composer/magento/community-edition | =2.4.3 | |
| <2.3.7 | ||
| >=2.4.0<2.4.3 | ||
| =2.3.7-p1 | ||
| =2.3.7-p2 | ||
| =2.4.3 | ||
| =2.4.3-p1 | ||
| <2.3.7 | ||
| >=2.4.0<2.4.3 | ||
| =2.3.7-p1 | ||
| =2.3.7-p2 | ||
| =2.4.3 | ||
| =2.4.3-p1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Adobe Commerce vulnerability?
The vulnerability ID for this Adobe Commerce vulnerability is CVE-2022-24093.
What versions of Adobe Commerce are affected by this vulnerability?
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by this vulnerability.
What is the severity of CVE-2022-24093?
CVE-2022-24093 has a severity rating of 7.2 (critical).
How does the vulnerability in Adobe Commerce affect the system?
The vulnerability in Adobe Commerce allows for an improper input validation vulnerability, which could result in a post-authentication arbitrary code execution.
Is user interaction required to exploit this vulnerability?
No, exploitation of this vulnerability does not require user interaction.
How can I fix this vulnerability in Adobe Commerce?
To fix this vulnerability in Adobe Commerce, update to versions 2.4.3-p2, 2.3.8-p1, or later.
Where can I find more information about this Adobe Commerce vulnerability?
You can find more information about this Adobe Commerce vulnerability on Adobe's website.
- agent/type
- agent/remedy
- agent/title
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/author
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5xmp-7wg5-x68q
- alias/CVE-2022-24093
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/references
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- vendor/adobe
- canonical/adobe magento
- version/adobe magento/2.4.0
- version/adobe magento/2.3.7-p1
- version/adobe magento/2.3.7-p2
- version/adobe magento/2.4.3
- version/adobe magento/2.4.3-p1
- canonical/adobe magento commerce
- version/adobe magento commerce/2.4.0
- version/adobe magento commerce/2.3.7-p1
- version/adobe magento commerce/2.3.7-p2
- version/adobe magento commerce/2.4.3
- version/adobe magento commerce/2.4.3-p1
- package-manager/composer