Vulnerability advisory

CVE-2022-24086

Adobe Commerce checkout improper input validation leads to remote code execution

Published Feb 16, 2022Updated Oct 28, 2026OSV record ↗

Also known as BIT-magento-2022-24086GHSA-f8fv-f786-9933

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/magento2 ↗
All commits before f4c1d7526f05bdfb1327b0701cc345f94aadcaed	`f4c1d7526f05bdfb1327b0701cc345f94aadcaed`
7aa94564d85e408baea01abc5315a0441401c375 through 53ad434d78cd2d357203fb82e5ea059883f403b8	No fix listed
6729b6e01368248abc33300208eb292c95050203 through 33242e4b19cf207d7b73f7791ef894b48bb41f8a	No fix listed
3c90474cbeac29921594ab97e68ca0502b5827a0 through 8afdb9858d238392ecb5dbfe556068ec1af137bc	No fix listed
Also listed as affected (38) `2.3.7-p1` `2.3.7-p2` `2.4.3-NA` `2.4.3-p1` `2.4.2` `2.3.6` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

CVE-2022-24086

Affected versions

Repository

Description

References