CVE-2022-42344: Magento Improper input validation vulnerability
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and privilege escalation.
Other sources
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation.
— MITRE
Magento Improper input validation vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.5 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.3-p3 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.7-p4
Event History
Frequently Asked Questions
What is the vulnerability ID of this Adobe Commerce vulnerability?
The vulnerability ID is CVE-2022-42344.
What is the severity of CVE-2022-42344?
The severity of CVE-2022-42344 is high with a severity value of 8.8.
What is the affected software for CVE-2022-42344?
The affected software for CVE-2022-42344 is Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier), and 2.4.4 (and earlier).
How does CVE-2022-42344 impact the system?
CVE-2022-42344 allows an authenticated attacker to trigger an insecure direct object reference in the V1/customers/me endpoint, leading to information exposure.
Is there a fix available for CVE-2022-42344?
Yes, Adobe has released a security update to address the vulnerability. Please refer to the reference link for more information.