Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper
    input validation vulnerability during the checkout process. Exploitation of this issue does not require
    user interaction and could result in arbitrary code execution. (CVE-2022-24086)

The version of Adobe Commerce/Magento Open Source installed on the remote host is prior to a patched version. It is, therefore, affected by a arbitracy code execution as referenced in the APSB22-12 advisory.

  - Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input     validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction     and could result in arbitrary code execution. (CVE-2022-24086)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
433524	SCA: security update for magento/community-edition (GHSA-f8fv-f786-9933)	Tenable Cloud Security	SCA Checks	Local	critical
433524	SCA: security update for magento/community-edition (GHSA-f8fv-f786-9933)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
242970	Adobe Commerce/Magento Open Source Input validation Vulnerability (APSB22-12)	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2022-24086

critical

Tenable Plugins

critical

critical

critical