Lucene search

GitHub_MVULNRICHMENT:CVE-2024-37295

HistoryJun 11, 2024 - 2:38 p.m.

CVE-2024-37295 Aimeos Core remote code execution in web server context

2024-06-1114:38:17

CWE-73

GitHub_M

github.com

cve-2024-37295

aimeos

remote code execution

web server

administrative privileges

php code

security vulnerability

file upload

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.

CNA Affected

[
  {
    "vendor": "aimeos",
    "product": "aimeos-core",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2024.04.1, < 2024.04.5"
      }
    ]
  }
]

References

github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.5 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for VULNRICHMENT:CVE-2024-37295