CVE-2024-39323
published 2024-07-02CVE-2024-39323: aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6…
PriorityP341high7.1CVSS 3.1
AVNACLPRLUINSUCNIHAL
EPSS
0.44%
35.5th percentile
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| aimeos | ai-admin-graphql | — | — |
| aimeos | ai-admin-graphql | — | — |
| aimeos | ai-admin-graphql | — | — |
| aimeos | ai-admin-graphql | >= 2022.04.1 < 2022.10.10 | 2022.10.10 |
| aimeos | ai-admin-graphql | >= 2023.04.1 < 2023.10.6 | 2023.10.6 |
| aimeos | ai-admin-graphql | >= 2024.04.1 < 2024.04.6 | 2024.04.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
ghsa·2024-07-02
CVE-2024-39323 [HIGH] CWE-1220 aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.
OSV
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
osv·2024-07-02
CVE-2024-39323 [HIGH] aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/aimeos/ai-admin-graphql/commit/2d89d98cdcad880a9244b50736b08c1a171379cahttps://github.com/aimeos/ai-admin-graphql/commit/54d6b7cf4530cb3b95f52775c24056c48e6d26e9https://github.com/aimeos/ai-admin-graphql/commit/787028de0a3ecbf3e9f63ab1454eac99ce7693a9https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-vc7j-99jw-jrqmhttps://github.com/aimeos/ai-admin-graphql/commit/2d89d98cdcad880a9244b50736b08c1a171379cahttps://github.com/aimeos/ai-admin-graphql/commit/54d6b7cf4530cb3b95f52775c24056c48e6d26e9https://github.com/aimeos/ai-admin-graphql/commit/787028de0a3ecbf3e9f63ab1454eac99ce7693a9https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-vc7j-99jw-jrqm
2024-07-02
Published