CVE-2022-24086

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24086
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24086.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-24086
Aliases
Published
2022-02-16T16:38:28.383Z
Modified
2026-08-12T03:51:26.012793638Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Adobe Commerce checkout improper input validation leads to remote code execution
Details

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

Database specific 
{
    "cwe_ids": [
        "CWE-20"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24086.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "2.4.3-p1"
                },
                {
                    "last_affected": "2.3.7-p2"
                },
                {
                    "last_affected": "None"
                }
            ]
        }
    ],
    "cna_assigner": "adobe"
}
References

Affected packages

Git / github.com/magento/magento2

Affected ranges

Type
GIT
Repo
https://github.com/magento/magento2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f4c1d7526f05bdfb1327b0701cc345f94aadcaed
Introduced
7aa94564d85e408baea01abc5315a0441401c375
Last affected
53ad434d78cd2d357203fb82e5ea059883f403b8
Introduced
6729b6e01368248abc33300208eb292c95050203
Last affected
33242e4b19cf207d7b73f7791ef894b48bb41f8a
Introduced
3c90474cbeac29921594ab97e68ca0502b5827a0
Last affected
8afdb9858d238392ecb5dbfe556068ec1af137bc
Database specific
Show details 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento:*:*:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento:2.3.7:p1:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:commerce:2.3.7:p2:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento:2.3.7:p2:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:commerce:2.4.3:-:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.3:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:adobe:commerce:2.4.3:p1:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento:2.4.3:p1:*:*:open_source:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.0"
        },
        {
            "last_affected": "2.3.6"
        },
        {
            "introduced": "2.3.3"
        },
        {
            "introduced": "2.4.0"
        },
        {
            "last_affected": "2.4.2"
        },
        {
            "introduced": "2.3.7-p1"
        },
        {
            "last_affected": "2.3.7-p1"
        },
        {
            "introduced": "2.3.7-p2"
        },
        {
            "last_affected": "2.3.7-p2"
        },
        {
            "introduced": "2.4.3-NA"
        },
        {
            "last_affected": "2.4.3-NA"
        },
        {
            "introduced": "2.4.3-p1"
        },
        {
            "last_affected": "2.4.3-p1"
        }
    ]
}

Affected versions

0.*
0.1.0-alpha100
0.1.0-alpha101
0.1.0-alpha102
0.1.0-alpha103
0.1.0-alpha104
0.1.0-alpha105
0.1.0-alpha106
0.1.0-alpha107
0.1.0-alpha108
0.1.0-alpha89
0.1.0-alpha90
0.1.0-alpha91
0.1.0-alpha92
0.1.0-alpha93
0.1.0-alpha94
0.1.0-alpha95
0.1.0-alpha96
0.1.0-alpha97
0.1.0-alpha98
0.1.0-alpha99
0.42.0-beta1
0.42.0-beta3
0.74.0-beta1
2.*
2.0.0
2.0.0-rc
2.1.0
2.1.0-rc1
2.1.0-rc2
2.1.0-rc3
2.2.0-RC1.1
2.2.0-RC1.2
2.2.0-RC1.3
2.3.6
2.3.7-p1
2.3.7-p2
2.4.2
2.4.3-NA
2.4.3-p1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-24086.json"