CVE-2022-24093: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by an improper input validation vulnerability that was discovered and disclosed in January 2022. The vulnerability affects both Adobe Commerce and Magento Open Source platforms across multiple versions (NVD, CVE).

The vulnerability is classified as an improper input validation issue (CWE-20). It has received a CVSS v3.1 base score of 9.1 (CRITICAL) from Adobe Systems Incorporated, with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The NVD assessment provided a slightly lower score of 7.2 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to post-authentication arbitrary code execution. The attack vector is network-accessible and does not require user interaction for exploitation, making it particularly dangerous for affected systems (CVE).

Adobe has released security updates to address this vulnerability. Users should upgrade Adobe Commerce to versions 2.4.3-p2, 2.4.4 or later, or 2.3.7-p3 for the 2.3.x branch. The same applies to Magento Open Source users (CERT-FR).