CVE-2024-39319 aimeos/ai-controller-frontend has IDOR vulnerability in account profile page
An insecure direct object reference allows attackers to disable subscriptions and reviews of other customers in Aimeos e-commerce projects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39319?
CVE-2024-39319 is a medium-severity missing authorization vulnerability in aimeos ai-controller-frontend, published on 26 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
Weakness: CWE-639
Which versions are affected by CVE-2024-39319?
10 open source packages ship an affected version, including aimeos/ai-controller-frontend. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aimeos/ai-controller-frontend Packagist | All versions | 2020.10.15 |
aimeos/ai-controller-frontend Packagist | All versions | 2020.10.15 |
aimeos/ai-controller-frontend Packagist | From 2021.04.1 | 2021.10.8 |
aimeos/ai-controller-frontend Packagist | From 2021.04.1 | 2021.10.8 |
aimeos/ai-controller-frontend Packagist | From 2022.04.1 | 2022.10.8 |
aimeos/ai-controller-frontend Packagist | From 2022.04.1 | 2022.10.8 |
4 more packages
aimeos/ai-controller-frontend Packagist | From 2023.04.1 | 2023.10.9 |
aimeos/ai-controller-frontend Packagist | From 2023.04.1 | 2023.10.9 |
aimeos/ai-controller-frontend Packagist | From 2024.04.1 | 2024.04.2 |
aimeos/ai-controller-frontend Packagist | From 2024.04.1 | 2024.04.2 |
Products include Aimeos Aimeos Frontend Controller.
How do I fix CVE-2024-39319?
Upgrade aimeos/ai-controller-frontend to a fixed version for your release line: 2020.10.15, 2021.10.8, 2022.10.8 or 2023.10.9.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-39319 being exploited?
There is no known exploitation of CVE-2024-39319 in the wild and no public exploit code.
Other vulnerabilities in aimeos ai-controller-frontend
Sources
Also known as GHSA-rw3j-574h-mrcq.