Aimeos HTML client may potentially reveal sensitive information in error log
Priority LOW 39CWE-1295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0051 43rd percentileScored 2026-11-07
Fix Fixed ai-client-html (aimeos): 2024.04.7, 2023.10.15, 2022.10.13 +1aimeos/ai-client-html (Packagist): 2024.04.7, 2023.10.15, 2022.10.13 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aimeos | ai-client-html | 2024.04.1 to before 2024.04.7; 2023.04.1 to before 2023.10.15; 2022.04.1 to before 2022.10.13; 2021.10.1 to before 2021.10.22 | 2024.04.7, 2023.10.15, 2022.10.13, 2021.10.22 | Patch available | CNA |
| — | aimeos/ai-client-html (Packagist) | 2024.04.1 to before 2024.04.7 | 2024.04.7 | Patch available | GHSA-ppm5-jv84-2xg2 |
| — | aimeos/ai-client-html (Packagist) | 2023.04.1 to before 2023.10.15 | 2023.10.15 | Patch available | GHSA-ppm5-jv84-2xg2 |
| — | aimeos/ai-client-html (Packagist) | 2022.04.1 to before 2022.10.13 | 2022.10.13 | Patch available | GHSA-ppm5-jv84-2xg2 |
| — | aimeos/ai-client-html (Packagist) | 2021.10.1 to before 2021.10.22 | 2021.10.22 | Patch available | GHSA-ppm5-jv84-2xg2 |
- ai-client-html Vendoraimeos Affected 2024.04.1 to before 2024.04.7; 2023.04.1 to before 2023.10.15; 2022.04.1 to before 2022.10.13; 2021.10.1 to before 2021.10.22 Fixed in 2024.04.7, 2023.10.15, 2022.10.13, 2021.10.22 Patch available CNA
- aimeos/ai-client-html (Packagist) Vendor— Affected 2024.04.1 to before 2024.04.7 Fixed in 2024.04.7 Patch available GHSA-ppm5-jv84-2xg2
- aimeos/ai-client-html (Packagist) Vendor— Affected 2023.04.1 to before 2023.10.15 Fixed in 2023.10.15 Patch available GHSA-ppm5-jv84-2xg2
- aimeos/ai-client-html (Packagist) Vendor— Affected 2022.04.1 to before 2022.10.13 Fixed in 2022.10.13 Patch available GHSA-ppm5-jv84-2xg2
- aimeos/ai-client-html (Packagist) Vendor— Affected 2021.10.1 to before 2021.10.22 Fixed in 2021.10.22 Patch available GHSA-ppm5-jv84-2xg2
Remediation
- Fix · CNA ai-client-html (aimeos) Fixed in 2024.04.7, 2023.10.15, 2022.10.13, 2021.10.22
- Fix · GHSA-ppm5-jv84-2xg2 aimeos/ai-client-html (Packagist) Fixed in 2024.04.7 Advisory →
- Fix · GHSA-ppm5-jv84-2xg2 aimeos/ai-client-html (Packagist) Fixed in 2023.10.15 Advisory →
- Fix · GHSA-ppm5-jv84-2xg2 aimeos/ai-client-html (Packagist) Fixed in 2022.10.13 Advisory →
- Fix · GHSA-ppm5-jv84-2xg2 aimeos/ai-client-html (Packagist) Fixed in 2021.10.22 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-38516
- 2026-10-03 Alias added: GHSA-ppm5-jv84-2xg2
References
More aimeos vulnerabilities
- TI-2021-22379 Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection CVSS 4.0HIGH 8.8
- TI-2024-24807 Aimeos Core remote code execution in web server context CVSS 3.1HIGH 7.2
- TI-2025-40895 Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors CVSS 3.1HIGH 7.7
- TI-2024-26279 aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account CVSS 3.1HIGH 7.1
- TI-2024-26275 aimeos/ai-controller-frontend has IDOR vulnerability in account profile page CVSS 3.1MEDIUM 5.3
- TI-2024-31541 Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups CVSS 3.1MEDIUM 5.5
Sources
- CVE-2024-38516 · CVE Program
- CVE-2024-38516 · NVD
- FIRST EPSS
- GHSA-ppm5-jv84-2xg2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences