Log in Start free

Vulnerability · Published Jun 11, 2024 · Assigned by GitHub_M

CVE-2024-37294Aimeos denial of service vulnerability in SaaS and marketplace setups

Medium 5.5

In plain English

A medium-severity security flaw in aimeos-core from aimeos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 62.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistaimeos/aimeos-core2024.04.7GHSA-xjm6-jfmg-qc6p
Packagistaimeos/aimeos-core2023.10.17GHSA-xjm6-jfmg-qc6p
Packagistaimeos/aimeos-core2022.10.17GHSA-xjm6-jfmg-qc6p

Affected products (as reported)

VendorProductVersions
aimeos aimeos-core >= 2024.04.1, < 2024.04.7>= 2023.04.1, < 2023.10.17>= 2022.04.1, < 2022.10.17

Weakness: CWE-270 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

References