Administrative Tasks JSON API Vulnerable to Improper Access Control
CVE-2024-39322

5.5MEDIUM

Key Information:

Vendor
aimeos
Status
Ai-controller-frontend
Vendor
CVE Published:
2 July 2024

Summary

aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.

References

https://github.com/aimeos/ai-admin-jsonadm/security/advis...
https://github.com/aimeos/ai-admin-jsonadm/commit/02a063f...
https://github.com/aimeos/ai-admin-jsonadm/commit/16d013d...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.