CVE-2022-42344

8.8 highEPSS 1.3%

High (8.8). EPSS 1.3% chance of exploitation in the next 30 days.

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Incorrect Authorization vulnerability. An authenticated attacker can exploit this vulnerability to achieve information exposure and privilege escalation.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWE: CWE-863
Published: 2022-10-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

adobe:commerce
magento:magento

References

https://helpx.adobe.com/security/products/magento/apsb22-38.html
https://helpx.adobe.com/security/products/magento/apsb22-38.html

Check your stack JSON