Critical Magento 0-Day Vulnerability Under Active Exploitation — Patch Released

Adobe on Sunday rolled out patches to contain a critical
security vulnerability impacting its Commerce and Magento Open
Source products that it said is being actively exploited in the
wild.

Tracked as CVE-2022-24086^[1], the shortcoming has a
CVSS score of 9.8 out of 10 on the vulnerability scoring system and
has been characterized as an “improper input validation^[2]” issue that could be
weaponized to achieve arbitrary code execution.

It’s also a pre-authenticated flaw, meaning it could be
exploited without requiring any credentials. But the
California-headquartered company also pointed out that the
vulnerability is only exploitable by an attacker with
administrative privileges.

The flaw affects Adobe Commerce and Magento Open Source 2.4.3-p1
and earlier versions as well as 2.3.7-p2 and earlier versions.
Adobe Commerce 2.3.3 and lower are not vulnerable.

“Adobe is aware that CVE-2022-24086 has been exploited in the
wild in very limited attacks targeting Adobe Commerce merchants,”
the company noted in an advisory published February 13, 2022.

The findings come as e-commerce malware and vulnerability
detection company Sansec disclosed^[3]
last week about a Magecart attack^[4]
that compromised 500 sites running the Magento 1 platform with a
credit card skimmer designed to siphon sensitive payment
information.