VYPR
← All advisories
Critical severity9.8CISA KEVNVD Advisory· Published Feb 16, 2022· Updated Jun 17, 2026

CVE-2022-24086

CVE-2022-24086

Description

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
magento/community-editionPackagist
>= 2.3.3-p1, < 2.3.7-p32.3.7-p3
magento/community-editionPackagist
>= 2.4.0, < 2.4.3-p22.4.3-p2

Affected products

13
  • osv-coords2 versions
    pkg:bitnami/magentopkg:composer/magento/community-edition
    < 2.3.0+ 1 more
    • (no CPE)range: < 2.3.0
    • (no CPE)range: >= 2.3.3-p1, < 2.3.7-p3
  • Adobe Inc./Magento Commercecpe-rescue
    Range: unspecified
  • Adobe Inc./Commerce5 versions
    cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*range: <2.3.0
    • cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*
    • cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*
  • Adobe Inc./Magento5 versions
    cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*+ 4 more
    • cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*range: <2.3.0
    • cpe:2.3:a:adobe:magento:2.3.7:p1:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.3.7:p2:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.3:-:*:*:open_source:*:*:*
    • cpe:2.3:a:adobe:magento:2.4.3:p1:*:*:open_source:*:*:*

Patches

Vulnerability mechanics

References

4

News mentions

1