PT-2024-28449 · Aimeos · Aimeos/Ai-Admin-Graphql

Ssshah2131 · Published 2024-07-02 · Updated 2024-10-15 · CVE-2024-39324

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions aimeos/ai-admin-graphql versions 2022.04.1 through 2022.10.9 aimeos/ai-admin-graphql versions 2022.10.10 through 2023.10.5 aimeos/ai-admin-graphql versions 2023.10.6 through 2024.4.1

Description The issue is related to improper access control in the Aimeos GraphQL API admin interface, allowing editors to manage their own services via the GraphQL API, which is not permitted in the JQAdm front end.

Recommendations For versions 2022.04.1 through 2022.10.9, update to version 2022.10.10 or later. For versions 2022.10.10 through 2023.10.5, update to version 2023.10.6 or later. For versions 2023.10.6 through 2024.4.1, update to version 2024.4.2 or later.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-1220

Related Identifiers

CVE-2024-39324

GHSA-JJ68-CP4V-98QF

Affected Products

Aimeos/Ai-Admin-Graphql

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39324.json · Exploit
• https://github.com/aimeos/ai-admin-graphql/commit/a839a5adf16fee4221d444b7d2f5140d8cabf0ac · Patch
• https://github.com/aimeos/ai-admin-graphql/commit/687059d7eb2e1d55a09ed72dad3814f35edad038 · Patch
• https://github.com/aimeos/ai-admin-graphql/commit/acbb044620f4ff8e8d78a775cd205ec47cf119b3 · Patch
• https://github.com/aimeos/ai-admin-graphql/commit/4eabc2b973509ffa5924e7f88c8f87ee96e93b38 · Patch
• https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-jj68-cp4v-98qf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jj68-cp4v-98qf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39324 · Security Note
• https://osv.dev/vulnerability/CVE-2024-39324 · Vendor Advisory
• https://github.com/aimeos/ai-admin-graphql · Note
• https://t.me/cvenotify/98108 · Telegram Post
• https://t.me/cvenotify/85065 · Telegram Post