PT-2025-4480 · Optimizely · Optimizely Configured Commerce

Published 2025-01-04 · Updated 2025-01-06 · CVE-2025-22384

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Optimizely Configured Commerce versions prior to 5.2.2408

Description A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.

Recommendations For versions prior to 5.2.2408, update to version 5.2.2408 or later to resolve the issue. As a temporary workaround, consider implementing additional validation on storefront requests to prevent the purchase of discontinued products. Restrict access to the Commerce B2B application until the update is applied to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-472

Related Identifiers

CVE-2025-22384

Affected Products

Optimizely Configured Commerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-22384 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22384 · Vendor Advisory
• https://support.optimizely.com/hc/en-us/articles/32694560473741-Configured-Commerce-Security-Advisory-COM-2024-02 · Vendor Advisory
• https://twitter.com/CVEnew/status/1875375481090125995 · Twitter Post
• https://t.me/cvedetector/14259 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1875389209038528923 · Twitter Post
• https://t.me/cvenotify/106289 · Telegram Post