Adobe · Commerce and Magento Open Source
CVE-2022-24086
Adobe Commerce checkout improper input validation leads to remote code execution
공격에 악용됨
치명적 9.8 공격 가능성: 99.2%
무엇인가
Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability during the checkout process. Exploitation of this issue does not require user interaction and could result in arbitrary code execution.
CISA: Adobe Commerce and Magento Open Source contain an improper input validation vulnerability which can allow for arbitrary code execution.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 3월 1일
Adobe의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2024. 7. 17. | Improper Restriction of XML External Entity Reference (XXE) | Commerce and Magento Open Source | 치명적 9.8 | >99.9% |
| 2026. 10. 27. | Unrestricted Upload of File with Dangerous Type | Commerce and Magento | 치명적 9.3 | 31% |
| 2026. 9. 24. | Commerce and Magento Incorrect Authorization Vulnerability | Commerce and Magento | 치명적 9.1 | 90% |
| 2026. 9. 8. | Improper Neutralization of Special Elements Used in a Template Engine | Commerce and Magento | 치명적 10.0 | 3.9% |
| 2026. 7. 7. | Path Traversal | ColdFusion | 치명적 10.0 | 42% |
| 2026. 5. 20. | Heap-Based Buffer Overflow | Acrobat and Reader | 높음 8.8 | 87% |
| 2026. 4. 13. | Use-After-Free | Acrobat | 높음 7.8 | 33% |
| 2026. 4. 13. | Prototype Pollution | Acrobat and Reader | 높음 8.6 | 7.2% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.