PT-2022-1535 · Adobe · Commerce

Published 2022-02-13 · Updated 2025-10-23 · CVE-2022-24086

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier)

Description The issue is related to an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution. There is an ongoing campaign called Xurum that exploits this critical flaw, putting businesses at risk. The vulnerability allows an attacker to execute code on the server without authentication.

Recommendations For Adobe Commerce versions 2.4.3-p1 and earlier, update to a version that includes the fix for this issue. For Adobe Commerce versions 2.3.7-p2 and earlier, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the checkout process until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-00739

BIT-MAGENTO-2022-24086

CVE-2022-24086

GHSA-F8FV-F786-9933

Affected Products

Commerce

References · 65

• 🔥 https://github.com/Mr-xn/CVE-2022-24086 · Exploit
• 🔥 https://github.com/oK0mo/CVE-2022-24086-RCE-PoC · Exploit
• 🔥 https://github.com/pescepilota/CVE-2022-24086 · Exploit
• 🔥 https://github.com/akr3ch/CVE-2022-24086 · Exploit
• 🔥❌ https://github.com/shakeman8/CVE-2022-24086-RCE · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-24086 · Security Note
• https://osv.dev/vulnerability/BIT-magento-2022-24086 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f8fv-f786-9933 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb22-12.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-00739 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24086 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://t.me/thehackernews/1883 · Telegram Post
• https://t.me/pentestingnews/18981 · Telegram Post
• https://twitter.com/fofabot/status/1691696236624224658 · Twitter Post