PT-2024-28448 · Aimeos · Aimeos/Ai-Admin-Graphql

Ssshah2131 · Published 2024-07-02 · Updated 2024-07-02 · CVE-2024-39323

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions aimeos/ai-admin-graphql versions 2022.04.01 through 2022.10.09 aimeos/ai-admin-graphql versions 2022.10.10 through 2023.10.05 aimeos/ai-admin-graphql versions 2023.10.06 through 2024.04.05

Description The issue is related to an improper access control vulnerability in the Aimeos GraphQL API admin interface, which allows an editor to modify and take over an admin account in the back end.

Recommendations For versions 2022.04.01 through 2022.10.09, update to version 2022.10.10 or later. For versions 2022.10.10 through 2023.10.05, update to version 2023.10.06 or later. For versions 2023.10.06 through 2024.04.05, update to version 2024.04.6 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-1220

Related Identifiers

CVE-2024-39323

GHSA-VC7J-99JW-JRQM

Affected Products

Aimeos/Ai-Admin-Graphql

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39323.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-39323 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39323 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vc7j-99jw-jrqm · Vendor Advisory
• https://github.com/aimeos/ai-admin-graphql/commit/787028de0a3ecbf3e9f63ab1454eac99ce7693a9 · Note
• https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-vc7j-99jw-jrqm · Note
• https://github.com/aimeos/ai-admin-graphql/commit/2d89d98cdcad880a9244b50736b08c1a171379ca · Note
• https://github.com/aimeos/ai-admin-graphql/commit/54d6b7cf4530cb3b95f52775c24056c48e6d26e9 · Note
• https://github.com/aimeos/ai-admin-graphql · Note
• https://t.me/cvenotify/85051 · Telegram Post