CVE-2025-22384

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.

Score

CVSS 3.1 7.5 High

Status

Analyzed - cve@mitre.org

Published

2025-01-04

Last modified

2025-01-06

Weaknesses

CWE-472

Affected products

• Configured Commerce (Optimizely)

References

• https://support.optimizely.com/hc/en-us/articles/32694560473741-Configured-Commerce-Security-Advisory-COM-2024-02