Vulnerability advisory

GHSA-f8fv-f786-9933

Magento improper input validation vulnerability

Published Feb 17, 2022Updated Oct 22, 2025OSV record ↗

Also known as BIT-magento-2022-24086CVE-2022-24086

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.3.3-p1` to before 2.3.7-p3	`2.3.7-p3`Advisories →
Also listed as affected (11) `2.3.3-p1` `2.3.4` `2.3.4-p2` `2.3.5` `2.3.5-p1` `2.3.5-p2` `2.3.6` `2.3.6-p1` `2.3.7` `2.3.7-p1` `2.3.7-p2`
`2.4.0` to before 2.4.3-p2	`2.4.3-p2`Advisories →
Also listed as affected (9) `2.4.0` `2.4.0-p1` `2.4.1` `2.4.1-p1` `2.4.2` `2.4.2-p1` `2.4.2-p2` `2.4.3` `2.4.3-p1`

Description

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

GHSA-f8fv-f786-9933

Affected versions

magento/community-edition Packagist

Description

References