Log in Start free

Vulnerability · Published Jun 11, 2024 · Assigned by GitHub_M

CVE-2024-37296Aimeos HTML client vulnerable to digital products download without proper payment status check

Medium 5.3

In plain English

A medium-severity missing authorization in ai-client-html from aimeos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 53.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistaimeos/ai-client-html2024.04.5GHSA-v4g2-cm5v-cxv7
Packagistaimeos/ai-client-html2023.10.14GHSA-v4g2-cm5v-cxv7
Packagistaimeos/ai-client-html2022.10.12GHSA-v4g2-cm5v-cxv7
Packagistaimeos/ai-client-html2021.10.21GHSA-v4g2-cm5v-cxv7
Packagistaimeos/ai-client-html2020.10.27GHSA-v4g2-cm5v-cxv7

Affected products (as reported)

VendorProductVersions
aimeos ai-client-html >= 2024.04.1, < 2024.04.5>= 2023.04.1, < 2023.10.14>= 2022.04.1, < 2022.10.12>= 2021.04.1, < 2021.10.21>= 2020.04.1, < 2020.10.27

Weakness: CWE-841, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References