PT-2024-27452 · Aimeos · Aimeos

Ssshah2131 · Published 2024-06-05 · Updated 2024-06-13 · CVE-2024-37295

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aimeos versions 2024.01.1 through 2024.04.4

Description The issue allows a user with administrative privileges to upload files that appear to be images but actually contain PHP code, which can then be executed in the context of the web server.

Recommendations For Aimeos versions 2024.01.1 through 2024.04.4, update to version 2024.04.5 to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2024-37295

GHSA-RHC2-23C2-WW7C

Affected Products

Aimeos

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37295.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37295 · Security Note
• https://osv.dev/vulnerability/GHSA-rhc2-23c2-ww7c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37295 · Vendor Advisory
• https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c · Note
• https://github.com/aimeos/aimeos-core · Note