Critical Magento zero-day vulnerability actively exploiting multiple e-commerce websites
Critical Magento zero-day vulnerability actively exploiting multiple e-commerce websites
THREAT LEVEL: Red.
For a detailed advisory, download the pdf file here
Adobe issued an emergency advisory informing Adobe Commerce and Magento Open-Source product users of a critical zero-day vulnerability that is being actively exploited in the wild.
A zero-day vulnerability which has been assigned CVE-2022-24086 affects the Adobe Commerce and Magento Open-Source products as they fail to properly validate the user input. A pre-authenticated attacker can exploit this to execute arbitrary code on the victim’s machine. This vulnerability is being exploited in the wild and targeting Adobe Commerce merchants.
Only three days later, Adobe updated same security advisory for the new vulnerability which is related to the earlier reported zero-day vulnerability (CVE-2022-24086) and assigned it CVE-2022-24087. This update has been issued for a new vulnerability that fixes the zero-day vulnerability’s incomplete patch.
Hive Pro threat research team advices organizations to patch these vulnerabilities as soon as possible using the patch links below.
Potential MITRE ATT&CK TTPs are:
TA0001: Initial Access
TA0002: Execution
TA0003: Persistence
TA0004: Privilege Escalation
TA0005: Defense Evasion
T1190: Exploit Public-Facing Application
T1078: Valid Accounts T1068: Exploitation for Privilege Escalation
Vulnerability Details
Patch Link
References
https://helpx.adobe.com/security/products/magento/apsb22-12.html
