aimeos/ai-client-html · Security
Digital products download without proper payment status check
- GHSA ID
- GHSA-v4g2-cm5v-cxv7
- CVE ID
- CVE-2024-37296
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 5.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Impact
Digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed.
Patches
New versions for the Aimeos HTML client 2020-2024 are available
CWEs
- CWE-841 · Improper Enforcement of Behavioral Workflow
References
- https://github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-37296 ↗
- https://github.com/aimeos/ai-client-html/commit/12d8aad1a373bf9d350872501adec3e222164f83 ↗
- https://github.com/aimeos/ai-client-html/commit/5a7249769142b3ce70959ab1fb70c7e7c251e214 ↗
- https://github.com/aimeos/ai-client-html/commit/6460ffe8f4929d864164aa96c5b49eca5326d975 ↗
- https://github.com/aimeos/ai-client-html/commit/7f01d2f4fbc67f5231fd84adeb835d28252b8409 ↗
- https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99346b561cea515c5f0 ↗
- https://github.com/advisories/GHSA-v4g2-cm5v-cxv7 ↗