Back to Database
Status published
Medium
CVE-2024-39322
aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records
Vulnerability Description
aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-39322
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/aimeos/ai-admin-jsonadm/security/advisories/GHSA-8fj2-587w-5whr
- https://github.com/aimeos/ai-admin-jsonadm/commit/02a063fbd616d4e0a5aaf89f1642a856aa5ac5a5
- https://github.com/aimeos/ai-admin-jsonadm/commit/16d013d0e28cecd19781f434d83fabebcc78cdc2
- https://github.com/aimeos/ai-admin-jsonadm/commit/4c966e02bd52589c3c9382777cfe170eddf17b00
- https://github.com/aimeos/ai-admin-jsonadm/commit/640954243ce85c2c303a00dd6481ed39b3d218fb
- https://github.com/aimeos/ai-admin-jsonadm/commit/7d1c05e8368b0a6419820fe402deac9960500026
More from aimeos
View All →CVE-2025-66468
Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors
High
7.7
CVE-2024-47173
Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups
Medium
5.5
CVE-2024-39325
aimeos/ai-controller-frontend doesn't reset payment status in basket
Medium
5.3
CVE-2024-39324
aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services
Low
3.8
CVE-2024-39323
aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
High
7.1
Affected Vendor
aimeos
View all reports →Affected Software
ai-admin-jsonadm
Vulnerable Versions:
= 2024.04.1, >= 2023.04.1, < 2023.10.4, >= 2022.04.1, < 2022.10.3, >= 2021.04.1, < 2021.10.6, < 2020.10.13
Timeline
Official Publish:
July 2nd, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H