{"id":"GHSA-f8fv-f786-9933","aliases":["BIT-magento-2022-24086","CVE-2022-24086"],"title":"Magento improper input validation vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"CRITICAL","description":"Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.","severity":"critical","score":9.8,"published":"2022-02-17T00:00:29.000Z","modified":"2025-10-22T19:24:44.377Z","withdrawn":false,"knownExploited":true,"affected":[{"ecosystem":"Packagist","name":"magento/community-edition","sources":[{"name":"OSV · GHSA-f8fv-f786-9933","url":"https://osv.dev/vulnerability/GHSA-f8fv-f786-9933"}],"ranges":[{"events":[{"introduced":"2.3.3-p1"},{"fixed":"2.3.7-p3"}],"type":"ECOSYSTEM"}],"versions":["2.3.3-p1","2.3.4","2.3.4-p2","2.3.5","2.3.5-p1","2.3.5-p2","2.3.6","2.3.6-p1","2.3.7","2.3.7-p1","2.3.7-p2"],"fixed":["2.3.7-p3"]},{"ecosystem":"Packagist","name":"magento/community-edition","sources":[{"name":"OSV · GHSA-f8fv-f786-9933","url":"https://osv.dev/vulnerability/GHSA-f8fv-f786-9933"}],"ranges":[{"events":[{"introduced":"2.4.0"},{"fixed":"2.4.3-p2"}],"type":"ECOSYSTEM"}],"versions":["2.4.0","2.4.0-p1","2.4.1","2.4.1-p1","2.4.2","2.4.2-p1","2.4.2-p2","2.4.3","2.4.3-p1"],"fixed":["2.4.3-p2"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2022-24086","https://github.com/magento/magento2","https://helpx.adobe.com/security/products/magento/apsb22-12.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24086"],"sources":[{"name":"OSV","id":"GHSA-f8fv-f786-9933","modified":"2025-10-22T19:24:44.377633Z","url":"https://osv.dev/vulnerability/GHSA-f8fv-f786-9933"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","score":9.8}],"products":[],"remediation":[],"kev":{"status":"listed","checkedAt":"2026-10-28T17:10:31.931Z","cveID":"CVE-2022-24086","vendorProject":"Adobe","product":"Commerce and Magento Open Source","vulnerabilityName":"Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability","dateAdded":"2022-02-15","shortDescription":"Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.","requiredAction":"Apply updates per vendor instructions.","dueDate":"2022-03-01","knownRansomwareCampaignUse":"Unknown","forensicTriage":"No","notes":"https://nvd.nist.gov/vuln/detail/CVE-2022-24086","cwes":["CWE-20"]},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T09:00:31.690Z","attemptedAt":"2026-10-28T09:00:31.690Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T09:00:31.693Z","attemptedAt":"2026-10-28T09:00:31.693Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T09:00:31.480Z","attemptedAt":"2026-10-28T09:00:31.480Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-28T09:00:31.691Z","attemptedAt":"2026-10-28T09:00:31.691Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2022-0975","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0975","modified":"Oct 21, 2025, 11:15:46 PM","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-28T09:00:31.480Z"},{"source":"NVD","id":"CVE-2022-24086","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24086","modified":"2026-06-17T04:31:16.010","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","checkedAt":"2026-10-28T09:00:31.690Z"},{"source":"NVD","id":"CVE-2022-24086","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24086","modified":"2026-06-17T04:31:16.010","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","checkedAt":"2026-10-28T09:00:31.690Z"},{"source":"FIRST EPSS","id":"CVE-2022-24086","url":"https://www.first.org/epss/","probability":0.99199,"percentile":0.99934,"date":"2026-10-27","checkedAt":"2026-10-28T09:00:31.691Z"},{"source":"GitHub Advisory Database","id":"GHSA-f8fv-f786-9933","url":"https://github.com/advisories/GHSA-f8fv-f786-9933","modified":"2025-10-22T19:14:05Z","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H","checkedAt":"2026-10-28T09:00:31.693Z"}]}