GitHub Advisoryadvisory · Packagist

GHSA-v4g2-cm5v-cxv7 Digital products download without proper payment status check

MEDIUM Published 2024-06-05 Modified 2024-06-11 Official page ↗
Aliases
CVE-2024-37296
Ecosystem
Packagist
Packages
aimeos/ai-client-html
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-841
Reviewed
2024-06-05

Affected packages

• Packagist aimeos/ai-client-html: >= 2024.04.1, < 2024.04.5 → fixed in 2024.04.5 • Packagist aimeos/ai-client-html: >= 2023.04.1, < 2023.10.14 → fixed in 2023.10.14 • Packagist aimeos/ai-client-html: >= 2022.04.1, < 2022.10.12 → fixed in 2022.10.12 • Packagist aimeos/ai-client-html: >= 2021.04.1, < 2021.10.21 → fixed in 2021.10.21 • Packagist aimeos/ai-client-html: >= 2020.04.1, < 2020.10.27 → fixed in 2020.10.27

Description

Impact Digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Patches New versions for the Aimeos HTML client 2020-2024 are available

Related

Alias · CVE (1)

  • CVE-2024-37296 The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. vulnerability

Weakness · CWE (1)

  • CWE-841 Improper Enforcement of Behavioral Workflow weakness

References