Aimeos HTML client vulnerable to digital products download without proper payment status check
Priority LOW 25CWE-841Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.
Summary
The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Fix Fixed ai-client-html (aimeos): 2024.04.5, 2023.10.14, 2022.10.12 +2aimeos/ai-client-html (Packagist): 2024.04.5, 2023.10.14, 2022.10.12 +2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aimeos | ai-client-html | 2024.04.1 to before 2024.04.5; 2023.04.1 to before 2023.10.14; 2022.04.1 to before 2022.10.12; 2021.04.1 to before 2021.10.21; 2020.04.1 to before 2020.10.27 | 2024.04.5, 2023.10.14, 2022.10.12, 2021.10.21, 2020.10.27 | Patch available | CNA |
| — | aimeos/ai-client-html (Packagist) | 2024.04.1 to before 2024.04.5 | 2024.04.5 | Patch available | GHSA-v4g2-cm5v-cxv7 |
| — | aimeos/ai-client-html (Packagist) | 2023.04.1 to before 2023.10.14 | 2023.10.14 | Patch available | GHSA-v4g2-cm5v-cxv7 |
| — | aimeos/ai-client-html (Packagist) | 2022.04.1 to before 2022.10.12 | 2022.10.12 | Patch available | GHSA-v4g2-cm5v-cxv7 |
| — | aimeos/ai-client-html (Packagist) | 2021.04.1 to before 2021.10.21 | 2021.10.21 | Patch available | GHSA-v4g2-cm5v-cxv7 |
| — | aimeos/ai-client-html (Packagist) | 2020.04.1 to before 2020.10.27 | 2020.10.27 | Patch available | GHSA-v4g2-cm5v-cxv7 |
- ai-client-html Vendoraimeos Affected 2024.04.1 to before 2024.04.5; 2023.04.1 to before 2023.10.14; 2022.04.1 to before 2022.10.12; 2021.04.1 to before 2021.10.21; 2020.04.1 to before 2020.10.27 Fixed in 2024.04.5, 2023.10.14, 2022.10.12, 2021.10.21, 2020.10.27 Patch available CNA
- aimeos/ai-client-html (Packagist) Vendor— Affected 2024.04.1 to before 2024.04.5 Fixed in 2024.04.5 Patch available GHSA-v4g2-cm5v-cxv7
- aimeos/ai-client-html (Packagist) Vendor— Affected 2023.04.1 to before 2023.10.14 Fixed in 2023.10.14 Patch available GHSA-v4g2-cm5v-cxv7
- aimeos/ai-client-html (Packagist) Vendor— Affected 2022.04.1 to before 2022.10.12 Fixed in 2022.10.12 Patch available GHSA-v4g2-cm5v-cxv7
- aimeos/ai-client-html (Packagist) Vendor— Affected 2021.04.1 to before 2021.10.21 Fixed in 2021.10.21 Patch available GHSA-v4g2-cm5v-cxv7
- aimeos/ai-client-html (Packagist) Vendor— Affected 2020.04.1 to before 2020.10.27 Fixed in 2020.10.27 Patch available GHSA-v4g2-cm5v-cxv7
Remediation
- Fix · CNA ai-client-html (aimeos) Fixed in 2024.04.5, 2023.10.14, 2022.10.12, 2021.10.21, 2020.10.27
- Fix · GHSA-v4g2-cm5v-cxv7 aimeos/ai-client-html (Packagist) Fixed in 2024.04.5 Advisory →
- Fix · GHSA-v4g2-cm5v-cxv7 aimeos/ai-client-html (Packagist) Fixed in 2023.10.14 Advisory →
- Fix · GHSA-v4g2-cm5v-cxv7 aimeos/ai-client-html (Packagist) Fixed in 2022.10.12 Advisory →
- Fix · GHSA-v4g2-cm5v-cxv7 aimeos/ai-client-html (Packagist) Fixed in 2021.10.21 Advisory →
- Fix · GHSA-v4g2-cm5v-cxv7 aimeos/ai-client-html (Packagist) Fixed in 2020.10.27 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-37296
- 2026-10-03 Alias added: GHSA-v4g2-cm5v-cxv7
References
Other 7
- https://github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7
- https://github.com/aimeos/ai-client-html/commit/12d8aad1a373bf9d350872501adec3e222164f83
- https://github.com/aimeos/ai-client-html/commit/5a7249769142b3ce70959ab1fb70c7e7c251e214
- https://github.com/aimeos/ai-client-html/commit/6460ffe8f4929d864164aa96c5b49eca5326d975
- https://github.com/aimeos/ai-client-html/commit/7f01d2f4fbc67f5231fd84adeb835d28252b8409
- https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99346b561cea515c5f0
- https://github.com/aimeos/ai-client-html
More aimeos vulnerabilities
- TI-2021-22379 Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection CVSS 4.0HIGH 8.8
- TI-2024-25751 Aimeos HTML client may potentially reveal sensitive information in error log CVSS 3.1HIGH 8.8
- TI-2024-24807 Aimeos Core remote code execution in web server context CVSS 3.1HIGH 7.2
- TI-2025-40895 Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors CVSS 3.1HIGH 7.7
- TI-2024-26279 aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account CVSS 3.1HIGH 7.1
- TI-2024-26275 aimeos/ai-controller-frontend has IDOR vulnerability in account profile page CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-37296 · CVE Program
- CVE-2024-37296 · NVD
- FIRST EPSS
- GHSA-v4g2-cm5v-cxv7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences