GitHub Advisoryadvisory · Packagist

GHSA-xjm6-jfmg-qc6p Aimeos denial of service vulnerability in SaaS and marketplace setups

MEDIUM Published 2024-05-29 Modified 2024-06-11 Official page ↗
Aliases
CVE-2024-37294
Ecosystem
Packagist
Packages
aimeos/aimeos-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-270
Reviewed
2024-05-29

Affected packages

• Packagist aimeos/aimeos-core: >= 2024.04.1, < 2024.04.7 → fixed in 2024.04.7 • Packagist aimeos/aimeos-core: >= 2023.04.1, < 2023.10.17 → fixed in 2023.10.17 • Packagist aimeos/aimeos-core: >= 2022.04.1, < 2022.10.17 → fixed in 2022.10.17

Description

Impact All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack Patches Upgrade to the latest 2022.10 LTS, 2023.10 LTS and 2024.04.7 version of the aimeos/aimeos-core package

Related

Alias · CVE (1)

  • CVE-2024-37294 Aimeos is an Open Source e-commerce framework for online shops. vulnerability

Weakness · CWE (1)

  • CWE-270 Privilege Context Switching Error weakness

References