Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 15/02/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| magento/community-edition | ≥ 2.3.3-p1, < 2.3.7-p3≥ 2.4.0, < 2.4.3-p2 | 2.3.7-p32.4.3-p2 |
| commerce | = 2.3.7= 2.4.3≥ 2.3.3, ≤ 2.3.6≥ 2.4.0, ≤ 2.4.2< 2.3.0 | 2.3.0 |
| magento | = 2.3.7= 2.4.3≥ 2.4.0, ≤ 2.4.2> 2.3.3, ≤ 2.3.6< 2.3.0 | 2.3.0 |
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free