Adobe has had to issue another software update after an out-of-band patch failed to fix a vulnerability in its e-commerce software.
Last weekend, the company released an out-of-band patch to fix a vulnerability in its Adobe Commerce and Magento Open Source e-commerce products.
The CVE-2022-24086 input validation bug allowed attackers to run their own code on e-commerce sites, making them vulnerable to cart skimmers. The company said that the attack had been exploited in the wild.
Adobe credited the new discovery to one of the bug researchers that found the original vulnerability. The researcher from security company Bugscale, who uses the Twitter handle @Blaklis, warned about Adobe's first patch on Twitter. "THIS IS NOT SUFFICIENT to be safe," they said, adding a comment that hinted at the cause of the problem: "take care of json/url encoded values".
Researchers at security company Positive Technologies also warned that they had bypassed the initial patch to exploit the vulnerability again. "We weren't the first," they added.
The additional research created a new vulnerability ID, CVE-2022-24087. It mirrors the first bug's 9.8 (critical) rating. Adobe released a fix for the bug, which customers must apply on top of the first patch.
This isn't the first critical vulnerability that Adobe has had to patch lately. Earlier this month it issued a patch for a critical bug, CVE-2022-23202, that enabled attackers to execute their own code in its Creative Cloud Desktop application.
It also patched an arbitrary code execution bug in Adobe After Effects, and another in Photoshop.
-
How to implement a four-day week in techIn-depth More companies are switching to a four-day week as they look to balance employee well-being with productivity
-
Intelligence sharing: The boost for businessesIn-depth Intelligence sharing with peers is essential if critical sectors are to be protected
-
Industry welcomes the NCSC’s new Vulnerability Research Initiative – but does it go far enough?News The cybersecurity agency will work with external researchers to uncover potential security holes in hardware and software
-
Hackers are targeting Ivanti VPN users again – here’s what you need to knowNews Ivanti has re-patched a security flaw in its Connect Secure VPN appliances that's been exploited by a China-linked espionage group since at least the middle of March.
-
Broadcom issues urgent alert over three VMware zero-daysNews The firm says it has information to suggest all three are being exploited in the wild
-
Nakivo backup flaw still present on some systems months after firms’ ‘silent patch’, researchers claimNews Over 200 vulnerable Nakivo backup instances have been identified months after the firm silently patched a security flaw.
-
Everything you need to know about the Microsoft Power Pages vulnerabilityNews A severe Microsoft Power Pages vulnerability has been fixed after cyber criminals were found to have been exploiting unpatched systems in the wild.
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long
-
A critical Ivanti flaw is being exploited in the wild – here’s what you need to knowNews Cyber criminals are actively exploiting a critical RCE flaw affecting Ivanti Connect Secure appliances
-
Researchers claim an AMD security flaw could let hackers access encrypted dataNews Using only a $10 test rig, researchers were able to pull off the badRAM attack
