PT-2024-27453 · Aimeos · Aimeos Html Client

Ssshah2131 · Published 2024-06-05 · Updated 2024-06-13 · CVE-2024-37296

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aimeos HTML client versions 2020.04.1 through 2020.10.26 Aimeos HTML client versions prior to 2021.10.21 Aimeos HTML client versions prior to 2022.10.12 Aimeos HTML client versions prior to 2023.10.14 Aimeos HTML client versions prior to 2024.04.5

Description The issue allows digital downloads sold in online shops to be downloaded without valid payment, for example, if the payment did not succeed.

Recommendations For versions 2020.04.1 through 2020.10.26, update to version 2020.10.27 or later. For versions prior to 2021.10.21, update to version 2021.10.21 or later. For versions prior to 2022.10.12, update to version 2022.10.12 or later. For versions prior to 2023.10.14, update to version 2023.10.14 or later. For versions prior to 2024.04.5, update to version 2024.04.5 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

CWE-841

Related Identifiers

CVE-2024-37296

GHSA-V4G2-CM5V-CXV7

Affected Products

Aimeos Html Client

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37296.json · Exploit
• https://osv.dev/vulnerability/GHSA-v4g2-cm5v-cxv7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37296 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37296 · Vendor Advisory
• https://github.com/aimeos/ai-client-html · Note
• https://github.com/aimeos/ai-client-html/commit/12d8aad1a373bf9d350872501adec3e222164f83 · Note
• https://github.com/aimeos/ai-client-html/commit/7f01d2f4fbc67f5231fd84adeb835d28252b8409 · Note
• https://github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7 · Note
• https://github.com/aimeos/ai-client-html/commit/5a7249769142b3ce70959ab1fb70c7e7c251e214 · Note
• https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99346b561cea515c5f0 · Note
• https://github.com/aimeos/ai-client-html/commit/6460ffe8f4929d864164aa96c5b49eca5326d975 · Note