GitHub Advisoryadvisory · Packagist

GHSA-rw3j-574h-mrcq IDOR vulnerability in account profile page

MEDIUM Published 2024-09-26 Modified 2025-03-05 Official page ↗
Aliases
CVE-2024-39319
Ecosystem
Packagist
Packages
aimeos/ai-controller-frontend
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-639
Reviewed
2024-09-26

Affected packages

• Packagist aimeos/ai-controller-frontend: >= 2024.04.1, < 2024.04.2 → fixed in 2024.04.2 • Packagist aimeos/ai-controller-frontend: >= 2023.04.1, < 2023.10.9 → fixed in 2023.10.9 • Packagist aimeos/ai-controller-frontend: >= 2022.04.1, < 2022.10.8 → fixed in 2022.10.8 • Packagist aimeos/ai-controller-frontend: >= 2021.04.1, < 2021.10.8 → fixed in 2021.10.8 • Packagist aimeos/ai-controller-frontend: < 2020.10.15 → fixed in 2020.10.15

Description

Impact Insecure direct object reference allowing an attacker to disable subscriptions and reviews of another customer

Related

Alias · CVE (1)

  • CVE-2024-39319 aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References