CVE-2024-39325 aimeos/ai-controller-frontend doesn't reset payment status in basket
Attackers can manipulate basket payment status after purchase due to missing reset logic, potentially leading to unauthorized state changes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39325?
CVE-2024-39325 is a medium-severity vulnerability in aimeos ai-controller-frontend, published on 2 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
Weakness: CWE-841
Which versions are affected by CVE-2024-39325?
8 open source packages ship an affected version, including aimeos/ai-controller-frontend. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aimeos/ai-controller-frontend Packagist | All versions | 2020.10.15 |
aimeos/ai-controller-frontend Packagist | All versions | 2020.10.15 |
aimeos/ai-controller-frontend Packagist | From 2021.04.1 | 2021.10.8 |
aimeos/ai-controller-frontend Packagist | From 2021.04.1 | 2021.10.8 |
aimeos/ai-controller-frontend Packagist | From 2022.04.1 | 2022.10.8 |
aimeos/ai-controller-frontend Packagist | From 2022.04.1 | 2022.10.8 |
2 more packages
aimeos/ai-controller-frontend Packagist | From 2023.04.1 | 2023.10.9 |
aimeos/ai-controller-frontend Packagist | From 2023.04.1 | 2023.10.9 |
Products include Aimeos Aimeos Frontend Controller.
How do I fix CVE-2024-39325?
Upgrade aimeos/ai-controller-frontend to a fixed version for your release line: 2020.10.15, 2021.10.8, 2022.10.8 or 2023.10.9.
Is CVE-2024-39325 being exploited?
There is no known exploitation of CVE-2024-39325 in the wild and no public exploit code.
Other vulnerabilities in aimeos ai-controller-frontend
Sources
Also known as GHSA-m9gv-6p22-qgmj.