CVE-2024-39324 — Incorrect Authorization in Ai-admin-graphql

CWE-863 — Incorrect AuthorizationCWE-1220 — Insufficient Granularity of Access Control3 documents3 sources
Severity
3.8LOWNVD
EPSS
0.1%
top 65.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Aimeos Ai-admin-graphql
Timeline
PublishedJul 2

Description

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:LExploitability: 1.2 | Impact: 2.5

Affected Packages3 packages

▶NVDaimeos/ai-admin-graphql2022.04.1 — 2022.10.10+2
▶Packagistaimeos/ai-admin-graphql2022.04.1 — 2022.10.10+2
▶CVEListV5aimeos/ai-admin-graphql= 2024.04.1, >= 2022.04.1, < 2022.10.10, >= 2023.04.1, < 2023.10.6+2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services↗2024-07-02
▶
GHSA
aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services↗2024-07-02
▶