Adobe Commerce | Improper Input Validation (CWE-20)

The vulnerability is an Improper Input Validation issue in Adobe Commerce, affecting versions 2.4.4-p14 through 2.4.9-alpha1. The root cause is insufficient validation of user-supplied input, allowing an attacker to inject specially crafted data that causes the application to crash or become unresponsive [1].

Exploitation does not require any user interaction. An unauthenticated remote attacker can send a crafted request to the affected endpoints, triggering the input validation flaw. No special privileges or network position beyond standard internet connectivity is needed [1].

Successful exploitation leads to a denial-of-service condition, rendering the Adobe Commerce application unavailable to legitimate users. This can disrupt eCommerce operations, leading to potential revenue loss and reputational damage.

Adobe has released security updates to address this vulnerability in the affected versions. Users are advised to apply the latest patches available from the Adobe Security Bulletin to mitigate the risk.