CVE-2024-39324 aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services

2024-07-0220:09:22

CWE-1220

CWE-863

GitHub_M

github.com

cve-2024-39324

aimeos/ai-admin-graphql

improper access control

vulnerability

editors

manage services

graphql api

jqadm

patch

CVSS3

3.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn’t allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue.

CNA Affected

[
  {
    "vendor": "aimeos",
    "product": "ai-admin-graphql",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2022.04.1, < 2022.10.10"
      },
      {
        "status": "affected",
        "version": ">= 2023.04.1, < 2023.10.6"
      },
      {
        "status": "affected",
        "version": "= 2024.04.1"
      }
    ]
  }
]