Configured Commerce

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:optimizely:configured_commerce:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorOptimizely (9afc6c86-bd96-53d1-823b-598874393d5d)
ProductConfigured Commerce (c0ba6c5c-8422-5966-b737-bdefee54a59f)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-22387 vulnerable 2026-06-08 07:10:53.001873 Details available
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking.
Published: 2025-01-04T00:00:00.000Z
Updated: 2025-01-06T17:01:10.261Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-22386 vulnerable 2026-06-08 07:10:53.001414 Details available
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity session issue exists in the Commerce B2B application, affecting the longevity of active sessions in the storefront. This allows session tokens tied to logged-out sessions to still be active and usable.
Published: 2025-01-04T00:00:00.000Z
Updated: 2025-01-06T15:18:53.183Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-22385 vulnerable 2026-06-08 07:10:53.000917 Details available
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors.
Published: 2025-01-04T00:00:00.000Z
Updated: 2025-01-06T15:13:34.352Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-22384 vulnerable 2026-06-08 07:10:53.000434 Details available
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue concerning business logic exists in the Commerce B2B application, which allows storefront visitors to purchase discontinued products in specific scenarios where requests are altered before reaching the server.
Published: 2025-01-04T00:00:00.000Z
Updated: 2025-01-06T17:02:30.455Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-22383 vulnerable 2026-06-08 07:10:52.999855 Details available
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity input validation issue exists in the Commerce B2B application, affecting the Contact Us functionality. This allows visitors to send e-mail messages that could contain unfiltered HTML markup in specific scenarios.
Published: 2025-01-04T00:00:00.000Z
Updated: 2025-01-06T15:06:03.946Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-56175 vulnerable 2026-06-08 06:54:17.481982 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-56174 vulnerable 2026-06-08 06:54:17.481660 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-56173 vulnerable 2026-06-08 06:54:17.481037 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.