Adobe · Commerce and Magento
CVE-2025-54236
Adobe Commerce | Improper Input Validation (CWE-20)
概要
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
CISA: Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
対処法
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
米国連邦機関の対応期限：2025年11月14日
Adobeのその他の悪用された脆弱性
| 追加日 | 脆弱性 | 製品 | 深刻度 | 攻撃の可能性 |
|---|---|---|---|---|
| 2026/10/27 | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | 緊急 9.3 | 47% |
| 2026/09/24 | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | 緊急 9.1 | 92% |
| 2026/09/08 | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | 緊急 10.0 | 99.4% |
| 2026/07/07 | Path Traversal | ColdFusion | 緊急 10.0 | 42% |
| 2026/05/20 | Heap-Based Buffer Overflow | Acrobat and Reader | 高 8.8 | 87% |
| 2026/04/13 | Use-After-Free | Acrobat | 高 7.8 | 33% |
| 2026/04/13 | Prototype Pollution | Acrobat and Reader | 高 8.6 | 7.3% |
| 2025/10/15 | Experience Manager Forms Code Execution | Experience Manager (AEM) Forms | 緊急 10.0 | 81% |
出典：Known Exploited Vulnerabilities（CISA、パブリックドメイン）、CVE records（cve.org）、EPSS（FIRST）。攻撃の可能性は、今後30日以内に誰かがその脆弱性の悪用を試みるというEPSSの推定値です。