Log in Start free

Vulnerability · Published Jul 2, 2024 · Assigned by GitHub_M

CVE-2024-39322aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records

Medium 5.5

In plain English

A medium-severity incorrect authorization in ai-admin-jsonadm from aimeos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.5%top 58.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistaimeos/ai-admin-jsonadm2024.04.2GHSA-8fj2-587w-5whr
Packagistaimeos/ai-admin-jsonadm2023.10.4GHSA-8fj2-587w-5whr
Packagistaimeos/ai-admin-jsonadm2022.10.3GHSA-8fj2-587w-5whr
Packagistaimeos/ai-admin-jsonadm2021.10.6GHSA-8fj2-587w-5whr
Packagistaimeos/ai-admin-jsonadm2020.10.13GHSA-8fj2-587w-5whr

Affected products (as reported)

VendorProductVersions
aimeos ai-admin-jsonadm = 2024.04.1>= 2023.04.1, < 2023.10.4>= 2022.04.1, < 2022.10.3>= 2021.04.1, < 2021.10.6< 2020.10.13

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

References