CVE-2024-39324 aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services
Editors can improperly manage their own services via the GraphQL API, bypassing restrictions present in the standard frontend interface.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39324?
CVE-2024-39324 is a low-severity missing authorization vulnerability in aimeos ai-admin-graphql, published on 2 Jul 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue.
Which versions are affected by CVE-2024-39324?
6 open source packages ship an affected version, including aimeos/ai-admin-graphql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aimeos/ai-admin-graphql Packagist | From 2022.04.1 | 2022.10.10 |
aimeos/ai-admin-graphql Packagist | From 2022.04.1 | 2022.10.10 |
aimeos/ai-admin-graphql Packagist | From 2023.04.1 | 2023.10.6 |
aimeos/ai-admin-graphql Packagist | From 2023.04.1 | 2023.10.6 |
aimeos/ai-admin-graphql Packagist | From 2024.04.1 | 2024.04.2 |
aimeos/ai-admin-graphql Packagist | From 2024.04.1 | 2024.04.2 |
Products include Aimeos Ai-Admin-Graphql.
How do I fix CVE-2024-39324?
Upgrade aimeos/ai-admin-graphql to a fixed version for your release line: 2022.10.10, 2023.10.6 or 2024.04.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-39324 being exploited?
There is no known exploitation of CVE-2024-39324 in the wild and no public exploit code.
Sources
Also known as GHSA-jj68-cp4v-98qf.