PatchTheCVEconfigured commerce vulnerabilities and fixes
Recent CVEs affecting configured commerce, with upgrade or downgrade steps. 8 tracked.
Also searched as: configuredcommerce.
configured commerce has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 8. Most recent: 2025-01-04. Highest priority: CVE-2024-56174 (score 41/100).
- CVE-2025-22387 HIGH 7.5 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2025-22386 HIGH 7.3 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2025-22385 MEDIUM 5.9 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2025-22384 HIGH 7.5 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2025-22383 MEDIUM 4.6 UPGRADE An issue was discovered in Optimizely Configured Commerce before 5.2.2408
- CVE-2024-56175 MEDIUM 6.1 UPGRADE In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed
- CVE-2024-56174 HIGH 8.1 UPGRADE In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed
- CVE-2024-56173 MEDIUM 4.7 UPGRADE In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed
FAQ
How do I fix configured commerce vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is configured commerce being exploited right now?
None of the tracked configured commerce CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which configured commerce CVE should I patch first?
CVE-2024-56174 currently ranks highest (41/100): In Optimizely Configured Commerce before 5.2.2408, malicious payloads can be stored and subsequently executed .