Vulnerability · Published Jun 25, 2024 · Assigned by GitHub_M
CVE-2024-38516Aimeos HTML client may potentially reveal sensitive information in error log
High 8.8
In plain English
A high-severity security flaw in ai-client-html from aimeos. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 56.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | aimeos/ai-client-html | 2024.04.7 | GHSA-ppm5-jv84-2xg2 |
| Packagist | aimeos/ai-client-html | 2023.10.15 | GHSA-ppm5-jv84-2xg2 |
| Packagist | aimeos/ai-client-html | 2022.10.13 | GHSA-ppm5-jv84-2xg2 |
| Packagist | aimeos/ai-client-html | 2021.10.22 | GHSA-ppm5-jv84-2xg2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| aimeos | ai-client-html | >= 2024.04.1, < 2024.04.7>= 2023.04.1, < 2023.10.15>= 2022.04.1, < 2022.10.13>= 2021.10.1, < 2021.10.22 |
Weakness: CWE-1295 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H