Log in Start free

Vulnerability · Published Jul 2, 2024 · Assigned by GitHub_M

CVE-2024-39323aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account

High 7.1

In plain English

A high-severity incorrect authorization in ai-admin-graphql from aimeos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 61.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistaimeos/ai-admin-graphql2022.10.10GHSA-vc7j-99jw-jrqm
Packagistaimeos/ai-admin-graphql2023.10.6GHSA-vc7j-99jw-jrqm
Packagistaimeos/ai-admin-graphql2024.04.6GHSA-vc7j-99jw-jrqm

Affected products (as reported)

VendorProductVersions
aimeos ai-admin-graphql >= 2022.04.1, < 2022.10.10>= 2023.04.1, < 2023.10.6>= 2024.04.1, < 2024.04.6

Weakness: CWE-1220, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

References