aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account

2024-07-0221:20:33

Google

osv.dev

aimeos

graphql

admin interface

improper access control

vulnerability

editor

modify

admin account

back end

security issue

fix

version 2022.04.01

version 2022.10.10

version 2023.10.6

version 2024.04.6

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

AI Score

6.6

Confidence

High

EPSS

Percentile

15.8%

JSON

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.