CVE-2025-22385

CVSS 3.1 Score 5.9 of 10 (medium)

Details

Published Jan 4, 2025
Updated: Jan 6, 2025
CWE ID 862

Summary

CVE-2025-22385 is a medium-severity vulnerability affecting Optimizely's Configured Commerce before version 5.2.2408. Newly created accounts in the Commerce B2B application do not require email confirmation, making it possible for attackers to mass-create new accounts. This issue can lead to database storage concerns and the creation of unwanted storefront accounts on behalf of visitors.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Configured Commerce

Affected Vendors

  • Optimizely

Advisories, Assessments, and Mitigations