CVE-2024-37294 Aimeos denial of service vulnerability in SaaS and marketplace setups
Attackers can cause denial of service in Aimeos SaaS and marketplace setups, requiring users to upgrade the core package.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-37294?
CVE-2024-37294 is a medium-severity denial of service vulnerability in aimeos-core, published on 11 Jun 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
Weakness: CWE-270
Which versions are affected by CVE-2024-37294?
6 open source packages ship an affected version, including aimeos/aimeos-core.
| Package | Affected | Fixed in |
|---|---|---|
aimeos/aimeos-core Packagist | From 2022.04.1 | 2022.10.17 |
aimeos/aimeos-core Packagist | From 2022.04.1 | 2022.10.17 |
aimeos/aimeos-core Packagist | From 2023.04.1 | 2023.10.17 |
aimeos/aimeos-core Packagist | From 2023.04.1 | 2023.10.17 |
aimeos/aimeos-core Packagist | From 2024.04.1 | 2024.04.7 |
aimeos/aimeos-core Packagist | From 2024.04.1 | 2024.04.7 |
How do I fix CVE-2024-37294?
Upgrade aimeos/aimeos-core to a fixed version for your release line: 2022.10.17, 2023.10.17 or 2024.04.7.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-37294 being exploited?
There is no known exploitation of CVE-2024-37294 in the wild and no public exploit code.
Sources
Also known as GHSA-xjm6-jfmg-qc6p.