GitHub_MVULNRICHMENT:CVE-2024-39323CVE-2024-39323 aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
AI Score
Confidence
High
EPSS
Percentile
15.8%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.
CNA Affected
[
{
"vendor": "aimeos",
"product": "ai-admin-graphql",
"versions": [
{
"status": "affected",
"version": ">= 2022.04.1, < 2022.10.10"
},
{
"status": "affected",
"version": ">= 2023.04.1, < 2023.10.6"
},
{
"status": "affected",
"version": ">= 2024.04.1, < 2024.04.6"
}
]
}
]References
github.com/aimeos/ai-admin-graphql/commit/2d89d98cdcad880a9244b50736b08c1a171379ca
github.com/aimeos/ai-admin-graphql/commit/54d6b7cf4530cb3b95f52775c24056c48e6d26e9
github.com/aimeos/ai-admin-graphql/commit/787028de0a3ecbf3e9f63ab1454eac99ce7693a9
github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-vc7j-99jw-jrqm
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
AI Score
Confidence
High
EPSS
Percentile
15.8%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial