{"id":"CVE-2022-24093","published":"2023-09-12T07:36:03Z","modified":"2025-02-27T20:56:18Z","title":"Adobe Commerce post-auth improper input validation leads to remote code execution","vendor":"Adobe","product":"Adobe Commerce","tier":"tail","description":{"text":"Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01508,"percentile":0.74318,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb22-13.html","tags":["vendor-advisory"]}],"priority":{"score":21.2,"factors":[{"name":"EPSS percentile","points":14.86},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"adobe","affectedVersions":[{"vendor":"Adobe","product":"Adobe Commerce","versions":["<= 2.3.7-p2"]}],"affected":[{"ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.3-p1, <2.4.3-p2",">=2.3.7-p1, <2.3.7-p3"],"patched":["2.4.3-p2","2.3.7-p3"],"from":["GHSA-5xmp-7wg5-x68q"],"provenance":"source"},{"ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"from":["GHSA-5xmp-7wg5-x68q"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-29005","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2021-39864","published":"2021-10-15","fixed":"2.3.7-p2","kev":false,"link":{"from":"CVE-2021-39864","to":"CVE-2022-24093","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:magento/community-edition","fromFixed":"2.3.7-p2","toFixed":"2.3.7-p3","daysApart":697}]}},{"cve":"CVE-2021-36043","published":"2021-09-01","fixed":"2.4.2-p2","kev":false},{"cve":"CVE-2021-36044","published":"2021-09-01","fixed":"2.4.2-p2","kev":false},{"cve":"CVE-2022-24086","published":"2022-02-16","fixed":"2.4.3-p2","kev":true},{"cve":"CVE-2022-24093","published":"2023-09-12","fixed":"2.4.3-p2","kev":false},{"cve":"CVE-2022-35692","published":"2022-08-19","fixed":"2.4.3-p3","kev":false},{"cve":"CVE-2022-35689","published":"2022-10-14","fixed":"2.4.4-p2","kev":false},{"cve":"CVE-2022-34253","published":"2022-08-16","fixed":"2.4.5","kev":false}],"package":"Packagist:magento/community-edition"}}