GitHub Advisoryadvisory · Packagist

GHSA-rhc2-23c2-ww7c Remote code execution in web server context

HIGH Published 2024-06-05 Modified 2024-06-11 Official page ↗
Aliases
CVE-2024-37295
Ecosystem
Packagist
Packages
aimeos/aimeos-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-73
Reviewed
2024-06-05

Affected packages

• Packagist aimeos/aimeos-core: >= 2024.04.1, < 2024.04.5 → fixed in 2024.04.5

Description

Impact User with administrative privileges and upload files that look like images but contain PHP code which can then be executed in the context of the web server.

Related

Alias · CVE (1)

  • CVE-2024-37295 Aimeos is an Open Source e-commerce framework for online shops. vulnerability

Weakness · CWE (1)

  • CWE-73 External Control of File Name or Path weakness

References