CVEvulnerability

CVE-2024-39322

5.5 MEDIUM Published 2024-07-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-07-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
CVSS 3.1 ([email protected])
5.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-863

Description

aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.

Affected configurations

• aimeos project ai-controller-frontend (< 2020.10.13) • aimeos project ai-controller-frontend (>= 2021.04.1 < 2021.10.6) • aimeos project ai-controller-frontend (>= 2022.04.1 < 2022.10.3) • aimeos project ai-controller-frontend (>= 2023.04.1 < 2023.10.4) • aimeos project ai-controller-frontend 2024.04.1

Related

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References