Auth bypass in Aimeos Ai-client-html
CVE-2024-37296
The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can b…
EPSS: 0.003 (51.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Aimeos Ai-client-html — versions >= 2024.04.1, < 2024.04.5, >= 2023.04.1, < 2023.10.14, >= 2022.04.1, < 2022.10.12
Weakness classification (CWE)
References
- https://github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7 (x_refsource_CONFIRM)
- https://github.com/aimeos/ai-client-html/commit/12d8aad1a373bf9d350872501adec3e222164f83 (x_refsource_MISC)
- https://github.com/aimeos/ai-client-html/commit/5a7249769142b3ce70959ab1fb70c7e7c251e214 (x_refsource_MISC)
- https://github.com/aimeos/ai-client-html/commit/6460ffe8f4929d864164aa96c5b49eca5326d975 (x_refsource_MISC)
- https://github.com/aimeos/ai-client-html/commit/7f01d2f4fbc67f5231fd84adeb835d28252b8409 (x_refsource_MISC)
- https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99346b561cea515c5f0 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-37296?
- CVE-2024-37296 is a medium-severity vulnerability in Aimeos Ai-client-html, classified under Improper Enforcement of Behavioral Workflow. CVSS score: 5.3/10. Published 2024-06-11.
- How severe is CVE-2024-37296?
- Medium severity. CVSS v3 base score is 5.3 out of 10.