Improper Input Validation Affecting magento/community-edition package, versions >=2.3.3-p1, <2.3.7-p3 >=2.4.0, <2.4.3-p2
Threat Intelligence
Exploit Maturity
Mature
EPSS
19.26% (97th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-MAGENTOCOMMUNITYEDITION-2400727
- published 14 Feb 2022
- disclosed 14 Feb 2022
- credit Unknown
Introduced: 14 Feb 2022
CVE-2022-24086 Open this link in a new tabHow to fix?
Upgrade magento/community-edition to version 2.3.7-p3, 2.4.3-p2 or higher.
Overview
magento/community-edition is a modern cloud eCommerce platform.
Affected versions of this package are vulnerable to Improper Input Validation which could lead to arbitrary code execution.
Note: This vulnerability is exploitable without credentials but only when the attacker has administrative privileges.
According to Adobe, users are advised to manually apply MDVA-43395 patch first and then MDVA-43443 on top of it in order to fix this security issue.
CVSS Scores
version 3.1