PatchTheCVECVE-2025-22385: An issue was discovered in Optimizely Configured Commerce before 5.2.2408
CVE-2025-22385 is a medium-severity flaw (CVSS 5.9) affecting configured commerce. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.9 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 74%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2025-01-04 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-22385?
configured commerce: upgrade to 5.2.2408. Exact commands for each OS are on this page.
Is CVE-2025-22385 being exploited?
CVE-2025-22385 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-22385 affect?
CVE-2025-22385 affects configured commerce. Severity is medium (CVSS 5.9). An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This c
How urgent is CVE-2025-22385?
Priority 32/100. Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-22387 HIGH 7.5 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2025-22386 HIGH 7.3 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2025-22384 HIGH 7.5 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2025-22383 MEDIUM 4.6 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2024-56175 MEDIUM 6.1 UPGRADE In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed