Lucene search

GitHub Advisory DatabaseGHSA-PPM5-JV84-2XG2

HistoryJun 25, 2024 - 5:26 p.m.

Aimeos HTML client may potentially reveal sensitive information in error log

2024-06-2517:26:56

CWE-1295

GitHub Advisory Database

github.com

aimeos

html client

sensitive information

error log

laravel

multi-vendor setups

admin access

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Impact

Debug information can reveal sensitive information from environment variables in error log

Affected platform

Laravel environments with multi-vendor setups and admin access for the vendors

Affected configurations

Vulners

Node

aimeosai-client-htmlRange<2021.10.22

aimeosai-client-htmlRange<2022.10.13

aimeosai-client-htmlRange<2023.10.15

aimeosai-client-htmlRange<2024.04.7

CPENameOperatorVersion
aimeos/ai-client-htmllt2021.10.22
aimeos/ai-client-htmllt2022.10.13
aimeos/ai-client-htmllt2023.10.15
aimeos/ai-client-htmllt2024.04.7

Name	Operator	Version
aimeos/ai-client-html	lt	2021.10.22
aimeos/ai-client-html	lt	2022.10.13
aimeos/ai-client-html	lt	2023.10.15
aimeos/ai-client-html	lt	2024.04.7

References

github.com/advisories/GHSA-ppm5-jv84-2xg2

github.com/aimeos/ai-client-html/commit/bb389620ffc3cf4a2f29c11a1e5f512049e0c132

github.com/aimeos/ai-client-html/security/advisories/GHSA-ppm5-jv84-2xg2

nvd.nist.gov/vuln/detail/CVE-2024-38516

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for GHSA-PPM5-JV84-2XG2