CVE-2025-22384

Published: Jan 4, 2025Modified: May 20, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.

Affected (1)

Products: Optimizely: Configured Commerce

1 product

Configured Commerce

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Optimizely Configured Commerce	Before 5.2.2408

Related CWEs

External Control of Assumed-Immutable Web Parameter

The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields.

References (1)

https://support.optimizely.com/hc/en-us/articles/32694560473741-Configured-Commerce-Security-Advisory-COM-2024-02

Source: cve@mitre.org

Vendor Advisory

Timeline

No history available yet.