# CVE-2022-24086

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

- Page: https://www.vulneraibility.com/cve/CVE-2022-24086
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-02-15; CISA due date 2022-03-01
- EPSS: 99.20% (percentile 99.9)
- Unvetted proof-of-concept code on GitHub: 9 GitHub proofs of concept · 1 Nuclei template (first 2022-02-20)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2024-02-27)
- Weakness: CWE-20
- Also known as: GHSA-f8fv-f786-9933
- Published: 2022-02-16

## Affected versions

- magento: affected < 2.3.0; fixed in 2.3.0 (Bitnami advisory, via OSV)
- Adobe Magento Commerce: affected <= 2.4.3-p1; <= 2.3.7-p2; <= None

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://helpx.adobe.com/security/products/magento/apsb22-12.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.