CVE-2025-22385CWE-862

An issue was discovered in Optimizely Configured Commerce before 5.2.2408

Medium · published January 4, 2025

CVSS v3.1
5.9
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-01-04T00:00Z
EPSS history
Timeline
  • 04 JAN 00:00Z
    An issue was discovered in Optimizely Configured Commerce before 5.2.2408
    cvelistv5