PT-2025-4479 · Optimizely · Optimizely Configured Commerce

Published 2025-01-04 · Updated 2025-05-20 · CVE-2025-22383

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Optimizely Configured Commerce versions prior to 5.2.2408

Description A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific scenarios.

Recommendations For versions prior to 5.2.2408, update to version 5.2.2408 or later to resolve the issue. As a temporary workaround, consider restricting the use of the Contact Us functionality until a patch is available. Avoid allowing visitors to send e-mail messages that could contain HTML markup in specific scenarios.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22383

Affected Products

Optimizely Configured Commerce

References · 8

• https://support.optimizely.com/hc/en-us/articles/32694923652493-Configured-Commerce-Security-Advisory-COM-2024-03 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-22383 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22383 · Vendor Advisory
• https://t.me/cvenotify/106288 · Telegram Post
• https://t.me/cvenotify/123141 · Telegram Post
• https://t.me/cvedetector/14258 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1875386648982176054 · Twitter Post
• https://twitter.com/CVEnew/status/1875375480146399458 · Twitter Post