CVE-2024-47173 Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups
Attackers can cause denial of service in Aimeos GraphQL admin interfaces within SaaS or marketplace setups.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47173?
CVE-2024-47173 is a medium-severity denial of service vulnerability in aimeos ai-admin-graphql, published on 24 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Aimeos is an e-commerce framework. All SaaS and marketplace setups using the Aimeos GraphQL API admin interface version from 2024.04 up to 2024.07.1 are affected by a potential denial of service attack. Version 2024.07.2 fixes the issue.
Weakness: CWE-270
Which versions are affected by CVE-2024-47173?
2 open source packages ship an affected version, including aimeos/ai-admin-graphql.
| Package | Affected | Fixed in |
|---|---|---|
aimeos/ai-admin-graphql Packagist | From 2024.04.1 | 2024.07.2 |
aimeos/ai-admin-graphql Packagist | From 2024.04.1 | 2024.07.2 |
How do I fix CVE-2024-47173?
Upgrade aimeos/ai-admin-graphql to 2024.07.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-47173 being exploited?
There is no known exploitation of CVE-2024-47173 in the wild and no public exploit code.
Sources
Also known as GHSA-qxgx-hvg3-v92w.