PatchTheCVECVE-2025-22384: An issue was discovered in Optimizely Configured Commerce before 5.2.2408
CVE-2025-22384 is a high-severity flaw (CVSS 7.5) affecting configured commerce. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 64%) |
| CISA exploited list | No |
| Weakness | CWE-472 |
| Published | 2025-01-04 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-22384?
configured commerce: upgrade to 5.2.2408. Exact commands for each OS are on this page.
Is CVE-2025-22384 being exploited?
CVE-2025-22384 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-22384 affect?
CVE-2025-22384 affects configured commerce. Severity is high (CVSS 7.5). An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in speci
How urgent is CVE-2025-22384?
Priority 40/100. High severity; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-22387 HIGH 7.5 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2025-22386 HIGH 7.3 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2025-22385 MEDIUM 5.9 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2025-22383 MEDIUM 4.6 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2024-56175 MEDIUM 6.1 UPGRADE In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed