GitHub Advisoryadvisory · Packagist

GHSA-8fj2-587w-5whr aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records

MEDIUM Published 2024-07-02 Modified 2024-07-05 Official page ↗
Aliases
CVE-2024-39322
Ecosystem
Packagist
Packages
aimeos/ai-admin-jsonadm
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-863
Reviewed
2024-07-02

Affected packages

• Packagist aimeos/ai-admin-jsonadm: >= 2024.04.1, < 2024.04.2 → fixed in 2024.04.2 • Packagist aimeos/ai-admin-jsonadm: >= 2023.04.1, < 2023.10.4 → fixed in 2023.10.4 • Packagist aimeos/ai-admin-jsonadm: >= 2022.04.1, < 2022.10.3 → fixed in 2022.10.3 • Packagist aimeos/ai-admin-jsonadm: >= 2021.04.1, < 2021.10.6 → fixed in 2021.10.6 • Packagist aimeos/ai-admin-jsonadm: < 2020.10.13 → fixed in 2020.10.13

Description

Improper access control allows editors to remove admin group and locale configuration in Aimeos backend

Related

Alias · CVE (1)

  • CVE-2024-39322 aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References