CVE-2024-37296CWE-841CWE-862

Aimeos HTML client vulnerable to digital products download without proper payment status check

Medium · published June 11, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.3th percentile
Weaknesses
CWE-841 · Improper Enforcement of Behavioral Workflow; CWE-862 · Missing Authorization
Published
2024-06-11T14:43Z
EPSS history
Timeline
  • 11 JUN 14:43Z
    Aimeos HTML client vulnerable to digital products download without proper payment status check
    cvelistv5