CVE-2024-37296 - CVE House
Back to Database
Status published Medium CVE-2024-37296

Aimeos HTML client vulnerable to digital products download without proper payment status check

Vulnerability Description

The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-37296

Credits & Attribution

No credits recorded in the NVD database.

References

More from aimeos

View All →
CVE-2025-66468
Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors
High 7.7
CVE-2024-47173
Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups
Medium 5.5
CVE-2024-39325
aimeos/ai-controller-frontend doesn't reset payment status in basket
Medium 5.3
CVE-2024-39324
aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services
Low 3.8
CVE-2024-39323
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
High 7.1

Affected Vendor

Affected Software

ai-client-html
Vulnerable Versions:
>= 2024.04.1, < 2024.04.5, >= 2023.04.1, < 2023.10.14, >= 2022.04.1, < 2022.10.12, >= 2021.04.1, < 2021.10.21, >= 2020.04.1, < 2020.10.27

Timeline

Official Publish: June 11th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-841 CWE-862

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1531 Account Access Removal
Impact