What is CVE-2022-24086?

CVE-2022-24086 is a critical vulnerability affecting Adobe Commerce and Magento Open Source versions 2.4.3-p1 and earlier, as well as 2.3.7-p2 and earlier. This improper input validation vulnerability can lead to arbitrary code execution without user interaction, posing a significant risk to e-commerce systems using the affected software. With a severity score of 9.8 (CVSS 3.x) and 10.0 (CVSS 2.0), it is crucial for organizations to address this issue to protect their systems and data.

Who is impacted by CVE-2022-24086?

The CVE-2022-24086 vulnerability affects users of Adobe Commerce and Magento Open Source, specifically those using versions 2.4.3-p1 and earlier, as well as 2.3.7-p2 and earlier. This critical vulnerability poses a significant risk to e-commerce systems and has been exploited in limited attacks targeting Adobe Commerce merchants. It's important to note that Adobe Commerce and Magento Open Source versions 2.3.0 to 2.3.3 are not affected by this vulnerability.

What to do if CVE-2022-24086 affected you

If you're affected by the CVE-2022-24086 vulnerability, it's crucial to take immediate action to protect your system. Follow these steps:

1. Check if your Adobe Commerce or Magento Open Source version is affected (2.4.3-p1 and earlier, or 2.3.7-p2 and earlier).

2. Update your installation by applying the MDVA-43395 patch, followed by the MDVA-43443 patch.

3. Follow the patch installation instructions provided in the Adobe Security Bulletin.

By taking these steps, you can mitigate the risk posed by this critical vulnerability and protect your e-commerce system.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2022-24086 vulnerability is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It is named "Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability" and was added to the catalog on February 15, 2022. Organizations are required to take action by March 1, 2022, which involves applying updates as per the vendor's instructions.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-20, which is an improper input validation issue affecting Adobe Commerce and Magento Open Source.

Learn More

For a comprehensive understanding of its description, severity, technical details, and affected software configurations, refer to the NVD page and the sources listed below.

• Adobe Security Bulletin

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

• Known Exploited Vulnerabilities Catalog