CVE-2025-22385 Details
Description
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. For newly created accounts, the Commerce B2B application does not require email confirmation. This medium-severity issue allows the mass creation of accounts. This could affect database storage; also, non-requested storefront accounts can be created on behalf of visitors.
A vulnerability exists in Optimizely Configured Commerce versions prior to 5.2.2408, where the B2B application does not require email confirmation for newly created accounts. This issue allows for the mass creation of accounts, potentially impacting database storage and leading to the creation of unsolicited storefront accounts on behalf of visitors.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 6, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://support.optimizely.com/hc/en-us/articles/32695419706637-Configured-Commerce-Security-Advisory-COM-2024-05 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| optimizely configured commerce | < 5.2.2408 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2025 | Initial Analysis | [email protected] |
| Jan 6, 2025 | CVE Modified | CISA-ADP |
| Jan 4, 2025 | New CVE Received | [email protected] |