Search
Find a vulnerability
Search criteria
4 vulnerabilities found for aimeos-core by aimeos
CVE-2024-37295 (GCVE-0-2024-37295)
Vulnerability from nvd – Published: 2024-06-11 14:38 – Updated: 2024-08-02 03:50
VLAI
EPSS
VEX
Title
Aimeos Core remote code execution in web server context
Summary
Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/aimeos/aimeos-core/security/ad… | x_refsource_CONFIRM |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| aimeos | aimeos-core |
Affected:
>= 2024.04.1, < 2024.04.5
|
|
| aimeos | aimeos-core |
Affected:
2024.01.1 , < 2024.04.5
(custom)
cpe:2.3:a:aimeos:aimeos-core:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:aimeos:aimeos-core:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "aimeos-core",
"vendor": "aimeos",
"versions": [
{
"lessThan": "2024.04.5",
"status": "affected",
"version": "2024.01.1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37295",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T17:22:47.879934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T17:22:52.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.094Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "aimeos-core",
"vendor": "aimeos",
"versions": [
{
"status": "affected",
"version": "\u003e= 2024.04.1, \u003c 2024.04.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T14:38:17.416Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c"
}
],
"source": {
"advisory": "GHSA-rhc2-23c2-ww7c",
"discovery": "UNKNOWN"
},
"title": "Aimeos Core remote code execution in web server context"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-37295",
"datePublished": "2024-06-11T14:38:17.416Z",
"dateReserved": "2024-06-05T20:10:46.496Z",
"dateUpdated": "2024-08-02T03:50:56.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37294 (GCVE-0-2024-37294)
Vulnerability from nvd – Published: 2024-06-11 14:16 – Updated: 2024-08-02 03:50
VLAI
EPSS
VEX
Title
Aimeos denial of service vulnerability in SaaS and marketplace setups
Summary
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-270 - Privilege Context Switching Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/aimeos/aimeos-core/security/ad… | x_refsource_CONFIRM |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| aimeos | aimeos-core |
Affected:
>= 2024.04.1, < 2024.04.7
Affected: >= 2023.04.1, < 2023.10.17 Affected: >= 2022.04.1, < 2022.10.17 |
|
| aimeos | aimeos-core |
Affected:
0 , < 2024.04.7
(custom)
Affected: 0 , < 2023.10.17 (custom) Affected: 0 , < 2022.10.17 (custom) cpe:2.3:a:aimeos:aimeos-core:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:aimeos:aimeos-core:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "aimeos-core",
"vendor": "aimeos",
"versions": [
{
"lessThan": "2024.04.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2023.10.17",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2022.10.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T17:07:16.523748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T17:10:16.585Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:55.957Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "aimeos-core",
"vendor": "aimeos",
"versions": [
{
"status": "affected",
"version": "\u003e= 2024.04.1, \u003c 2024.04.7"
},
{
"status": "affected",
"version": "\u003e= 2023.04.1, \u003c 2023.10.17"
},
{
"status": "affected",
"version": "\u003e= 2022.04.1, \u003c 2022.10.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-270",
"description": "CWE-270: Privilege Context Switching Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T14:16:29.756Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p"
}
],
"source": {
"advisory": "GHSA-xjm6-jfmg-qc6p",
"discovery": "UNKNOWN"
},
"title": "Aimeos denial of service vulnerability in SaaS and marketplace setups"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-37294",
"datePublished": "2024-06-11T14:16:29.756Z",
"dateReserved": "2024-06-05T20:10:46.496Z",
"dateUpdated": "2024-08-02T03:50:55.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37295 (GCVE-0-2024-37295)
Vulnerability from cvelistv5 – Published: 2024-06-11 14:38 – Updated: 2024-08-02 03:50
VLAI
EPSS
VEX
Title
Aimeos Core remote code execution in web server context
Summary
Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/aimeos/aimeos-core/security/ad… | x_refsource_CONFIRM |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| aimeos | aimeos-core |
Affected:
>= 2024.04.1, < 2024.04.5
|
|
| aimeos | aimeos-core |
Affected:
2024.01.1 , < 2024.04.5
(custom)
cpe:2.3:a:aimeos:aimeos-core:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:aimeos:aimeos-core:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "aimeos-core",
"vendor": "aimeos",
"versions": [
{
"lessThan": "2024.04.5",
"status": "affected",
"version": "2024.01.1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37295",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T17:22:47.879934Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T17:22:52.398Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.094Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "aimeos-core",
"vendor": "aimeos",
"versions": [
{
"status": "affected",
"version": "\u003e= 2024.04.1, \u003c 2024.04.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73: External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T14:38:17.416Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c"
}
],
"source": {
"advisory": "GHSA-rhc2-23c2-ww7c",
"discovery": "UNKNOWN"
},
"title": "Aimeos Core remote code execution in web server context"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-37295",
"datePublished": "2024-06-11T14:38:17.416Z",
"dateReserved": "2024-06-05T20:10:46.496Z",
"dateUpdated": "2024-08-02T03:50:56.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37294 (GCVE-0-2024-37294)
Vulnerability from cvelistv5 – Published: 2024-06-11 14:16 – Updated: 2024-08-02 03:50
VLAI
EPSS
VEX
Title
Aimeos denial of service vulnerability in SaaS and marketplace setups
Summary
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-270 - Privilege Context Switching Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/aimeos/aimeos-core/security/ad… | x_refsource_CONFIRM |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| aimeos | aimeos-core |
Affected:
>= 2024.04.1, < 2024.04.7
Affected: >= 2023.04.1, < 2023.10.17 Affected: >= 2022.04.1, < 2022.10.17 |
|
| aimeos | aimeos-core |
Affected:
0 , < 2024.04.7
(custom)
Affected: 0 , < 2023.10.17 (custom) Affected: 0 , < 2022.10.17 (custom) cpe:2.3:a:aimeos:aimeos-core:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:aimeos:aimeos-core:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "aimeos-core",
"vendor": "aimeos",
"versions": [
{
"lessThan": "2024.04.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2023.10.17",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "2022.10.17",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37294",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-11T17:07:16.523748Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T17:10:16.585Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:55.957Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "aimeos-core",
"vendor": "aimeos",
"versions": [
{
"status": "affected",
"version": "\u003e= 2024.04.1, \u003c 2024.04.7"
},
{
"status": "affected",
"version": "\u003e= 2023.04.1, \u003c 2023.10.17"
},
{
"status": "affected",
"version": "\u003e= 2022.04.1, \u003c 2022.10.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-270",
"description": "CWE-270: Privilege Context Switching Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-11T14:16:29.756Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p"
}
],
"source": {
"advisory": "GHSA-xjm6-jfmg-qc6p",
"discovery": "UNKNOWN"
},
"title": "Aimeos denial of service vulnerability in SaaS and marketplace setups"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-37294",
"datePublished": "2024-06-11T14:16:29.756Z",
"dateReserved": "2024-06-05T20:10:46.496Z",
"dateUpdated": "2024-08-02T03:50:55.957Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}