CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-39325

Medium Severity
Aimeos
SVRS
30/100
CVSSv3
5.3/10
EPSS
0.00161/1

CVE-2024-39325 in Aimeos allows for potential payment status manipulation due to the failure to reset a user's basket after purchase. This vulnerability affects versions prior to 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15. The Aimeos frontend controller doesn't properly clear the payment status, posing a risk of repeated or fraudulent charges. Despite a moderate CVSS score of 5.3, organizations should apply the fixes provided in the updated versions to prevent exploitation. The SVRS score of 30 indicates a relatively low immediate threat level, but patching remains crucial for maintaining data integrity and preventing financial fraud. Upgrade to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, or 2020.10.15 to mitigate this risk.

TAGS
In The Wild
VECTOR STRING
CVSS:3.1
AV:N
AC:L
PR:N
UI:N
S:U
C:N
I:L
A:N
PUBLICATION DATE2024-07-02
LAST MODIFIED2024-10-15

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-39325 | aimeos ai-controller-frontend Payment Status behavioral workflow
vuldb.com2024-07-02
CVE-2024-39325 | aimeos ai-controller-frontend Payment Status behavioral workflow | A vulnerability was found in aimeos ai-controller-frontend. It has been classified as problematic. This affects an unknown part of the component Payment Status Handler. The manipulation leads to enforcement of behavioral workflow. This vulnerability is uniquely identified as CVE-2024-39325. It is possible to initiate the attack remotely. There is
cve-2024-39325
domains
urls
cves

Social Media

🚨 ai-controller-frontend Moderate vuln: Payment status in basket not reset. Impact: Potential manipulation. CVE-2024-39325. Action: Update to patched version 2023.10.9. #CyberAlert #EcommerceSecurity
0
0
0
CVE-2024-39325 aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-f… https://t.co/CICjA4asbP
0
0
0

Affected Software

Configuration 1
TypeVendorProduct
AppAimeosaimeos_frontend_controller

References

ReferenceLink
[email protected]https://github.com/aimeos/ai-controller-frontend/commit/16b8837d2466e3665b3c826ce87934b01a847268
[email protected]https://github.com/aimeos/ai-controller-frontend/commit/24a57001e56759d1582d2a0080fc1ca3ba328630
[email protected]https://github.com/aimeos/ai-controller-frontend/commit/28549808e0f6432a34cd3fb95556deeb86ca276d
[email protected]https://github.com/aimeos/ai-controller-frontend/commit/b1960c0b6e5ee93111a5360c9ce949b3e7528cf7
[email protected]https://github.com/aimeos/ai-controller-frontend/commit/dafa072783bb692f111ed092d9d2932c113eb855
[email protected]https://github.com/aimeos/ai-controller-frontend/security/advisories/GHSA-m9gv-6p22-qgmj

CWE Details

CWE IDCWE NameDescription
CWE-841Improper Enforcement of Behavioral WorkflowThe software supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence