Adobe Commerce checkout improper input validation leads to remote code execution (Adobe Magento Commerce)
En bref
- Source
- NVD
- EPSS
- EPSS 99.20 % · centile 100 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- adobe
- Statut NVD
- Analyzed
Description
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
Faiblesses (CWE)
- CWE-20 — Validation d'entrée incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | adobe |
| CVSS 3.1 | CRITICAL 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · psirt@adobe.com (Secondary) |
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-f8fv-f786-9933 — Magento improper input validation vulnerability
Références européennes
- ENISA EUVD · EUVD-2022-0975
- GCVE · GCVE-0-2022-24086
Avis du CERT-FR
- CERTFR-2022-AVI-167 — Multiples vulnérabilités dans Adobe Commerce · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*< 2.3.0cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*≥ 2.3.3 ≤ 2.3.6cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*< 2.3.0cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*> 2.3.3 ≤ 2.3.6cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:adobe:magento:2.3.7:p1:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.3.7:p2:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.3:-:*:*:open_source:*:*:*cpe:2.3:a:adobe:magento:2.4.3:p1:*:*:open_source:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Adobe · Magento Commerce | affected unspecified ≤ 2.4.3-p1 ; affected unspecified ≤ 2.3.7-p2 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |