CVE-2024-39322 MEDIUM

CVE-2024-39322: aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records

Vendor Aimeos
Product ai-admin-jsonadm
Weakness CWE-863 · Incorrect authorization
Published July 2, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.

Key dates

02Disclosure timeline

July 2, 2024 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-13282 Block permissions - Moderately critical - Access bypass - SA-CONTRIB-2024-046 CVE-2022-39956 Partial rule set bypass in OWASP ModSecurity Core Rule Set for HTTP multipart requests using character encoding in the Content-Type or Content-Transfer-Encoding header CVE-2025-0765 Incorrect Authorization in GitLab CVE-2025-46702 Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management CVE-2025-69289 Discourse has insecure default configuration that allows non-admin moderators to takeover any non-staff account via email change