9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-54236

CVE-2025-54236: Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-54236

CVE-2025-54236:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions
magento/community-edition	composer	<= 2.4.5-p14
magento/community-edition	composer	= 2.4.6
magento/community-edition	composer	>= 2.4.6-p1, <= 2.4.6-p12
magento/community-edition	composer	= 2.4.5
magento/community-edition	composer	>= 2.4.9-alpha1, <= 2.4.9-alpha2
magento/community-edition	composer	= 2.4.7
magento/community-edition	composer	= 2.4.8
magento/community-edition	composer	>= 2.4.7-beta1, <= 2.4.7-p7
magento/community-edition	composer	>= 2.4.8-beta1, <= 2.4.8-p2
magento/community-edition	composer	= 2.4.9
magento/project-community-edition	composer	<= 2.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis began by reviewing the provided vulnerability information and reference URLs. The Adobe security bulletin (APSB25-88) and the CVE description pointed to an 'Improper Input Validation' vulnerability in Magento. To understand the technical details, I investigated external resources found through a Google search for the CVE. A key resource was a blog post from Sansec ('SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236)'), which described the attack as combining a malicious session with a nested deserialization bug in Magento's REST API. Another critical piece of information came from an Adobe developer guide titled 'Adobe Commerce REST API constructor parameter injection changes'. This guide explicitly linked the changes to CVE-2025-54236 and detailed the remediation. It specified that the ServiceInputProcessor class was modified to perform stricter data type validation for constructor parameters, and that this validation was added to the getConstructorData() method. This indicates that, prior to the patch, this method was the entry point for the vulnerability, as it would process malicious API payloads without proper validation, leading to the instantiation of unintended and potentially malicious objects. Based on this strong evidence from Adobe's own documentation, I identified Magento\Webapi\Model\ServiceInputProcessor::getConstructorData as the vulnerable function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.