Vulnerabilities > CVE-2024-39324 - Incorrect Authorization vulnerability in Aimeos Ai-Admin-Graphql

CVSS 3.8 - LOW

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

HIGH

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

LOW

network

low complexity

aimeos

CWE-863

NVD

Published: 2024-07-02

Updated: 2024-10-15

Summary

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue.

Vulnerable Configurations

Part	Description	Count
Application	Aimeos Aimeos AI Admin Graphql 2022.10.1 Aimeos AI Admin Graphql 2022.10.2 Aimeos AI Admin Graphql 2022.10.3 Aimeos AI Admin Graphql 2022.10.4 Aimeos AI Admin Graphql 2022.10.5 Aimeos AI Admin Graphql 2022.10.6 Aimeos AI Admin Graphql 2022.10.7 Aimeos AI Admin Graphql 2022.10.8 Aimeos AI Admin Graphql 2022.10.9 Aimeos AI Admin Graphql 2024.04.1 Aimeos AI Admin Graphql 2023.04.1 Aimeos AI Admin Graphql 2023.04.2 Aimeos AI Admin Graphql 2023.04.3 Aimeos AI Admin Graphql 2023.07.1 Aimeos AI Admin Graphql 2023.07.2 Aimeos AI Admin Graphql 2023.10.1 Aimeos AI Admin Graphql 2023.10.2 Aimeos AI Admin Graphql 2023.10.3 Aimeos AI Admin Graphql 2023.10.4 Aimeos AI Admin Graphql 2023.10.5	20

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References