PT-2022-6967 · Adobe · Magento Open Source+1

Published 2022-04-12 · Updated 2023-09-18 · CVE-2022-24093

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.3-p1 and earlier Adobe Commerce versions 2.3.7-p2 and earlier

Description The issue is related to an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution. This vulnerability affects Adobe Commerce and Magento Open Source platforms, allowing a remote attacker to execute arbitrary code.

Recommendations For Adobe Commerce versions 2.4.3-p1 and earlier, update to a version later than 2.4.3-p1 to resolve the issue. For Adobe Commerce versions 2.3.7-p2 and earlier, update to a version later than 2.3.7-p2 to resolve the issue. As a temporary workaround, consider restricting input validation to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-05916

CVE-2022-24093

GHSA-5XMP-7WG5-X68Q

Affected Products

Commerce

Magento Open Source

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2022-24093 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb22-13.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05916 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24093 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5xmp-7wg5-x68q · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://t.me/cvenotify/58038 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022041244 · Note
• https://twitter.com/cracbot/status/1701838171326312455 · Twitter Post
• https://t.me/cibsecurity/70250 · Telegram Post
• https://vuldb.com/ru/?id.239480 · Note
• https://twitter.com/CVEnew/status/1701504148221354075 · Twitter Post