CVE-2025-22384

High

Published: 04 January 2025

Published

04 January 2025

Modified

20 May 2025

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0027 50.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-22384 is a high-severity External Control of Assumed-Immutable Web Parameter (CWE-472) vulnerability in Optimizely Configured Commerce. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 49.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires server-side validation of request parameters to independently verify product discontinuation status, preventing bypass via altered requests.

AC-3 Access Enforcement good match

prevent

Enforces access control policies that deny logical access to purchase discontinued products, directly addressing the business logic flaw.

SC-14 Public Access Protections partial match

prevent

Provides protections for public-facing storefront access to system resources like products, limiting unauthorized actions on discontinued items.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Direct unauthenticated exploitation of a public-facing web commerce application via request manipulation to bypass server-side business logic controls.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the…

server.

Deeper analysisAI

CVE-2025-22384 is a business logic vulnerability in Optimizely Configured Commerce versions prior to 5.2.2408, affecting the Commerce B2B application. The flaw enables storefront visitors to purchase discontinued products in specific scenarios by altering requests before they reach the server. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and maps to CWE-472 and NVD-CWE-Other.

Unauthenticated attackers with network access can exploit this issue with low attack complexity and no user interaction. By modifying requests en route to the server, they bypass controls on discontinued products, achieving high-impact unauthorized disclosure of confidential information.

Optimizely's security advisory (COM-2024-02) at https://support.optimizely.com/hc/en-us/articles/32694560473741-Configured-Commerce-Security-Advisory-COM-2024-02 provides details on the vulnerability. Mitigation requires upgrading to Configured Commerce 5.2.2408 or later.