aimeos/ai-controller-frontend has IDOR vulnerability in account profile page
Priority LOW 31CWE-639Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00485 42nd percentileScored 2026-11-07
Fix Fixed ai-controller-frontend (aimeos): 2023.10.9, 2022.10.8, 2021.10.8 +1aimeos/ai-controller-frontend (Packagist): 2024.04.2, 2023.10.9, 2022.10.8 +2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aimeos | ai-controller-frontend | = 2024.04.1; 2023.04.1 to before 2023.10.9; 2022.04.1 to before 2022.10.8; 2021.04.1 to before 2021.10.8; before 2020.10.15 | 2023.10.9, 2022.10.8, 2021.10.8, 2020.10.15 | Patch available | CNA |
| — | aimeos/ai-controller-frontend (Packagist) | 2024.04.1 to before 2024.04.2 | 2024.04.2 | Patch available | GHSA-rw3j-574h-mrcq |
| — | aimeos/ai-controller-frontend (Packagist) | 2023.04.1 to before 2023.10.9 | 2023.10.9 | Patch available | GHSA-rw3j-574h-mrcq |
| — | aimeos/ai-controller-frontend (Packagist) | 2022.04.1 to before 2022.10.8 | 2022.10.8 | Patch available | GHSA-rw3j-574h-mrcq |
| — | aimeos/ai-controller-frontend (Packagist) | 2021.04.1 to before 2021.10.8 | 2021.10.8 | Patch available | GHSA-rw3j-574h-mrcq |
| — | aimeos/ai-controller-frontend (Packagist) | before 2020.10.15 | 2020.10.15 | Patch available | GHSA-rw3j-574h-mrcq |
- ai-controller-frontend Vendoraimeos Affected = 2024.04.1; 2023.04.1 to before 2023.10.9; 2022.04.1 to before 2022.10.8; 2021.04.1 to before 2021.10.8; before 2020.10.15 Fixed in 2023.10.9, 2022.10.8, 2021.10.8, 2020.10.15 Patch available CNA
- aimeos/ai-controller-frontend (Packagist) Vendor— Affected 2024.04.1 to before 2024.04.2 Fixed in 2024.04.2 Patch available GHSA-rw3j-574h-mrcq
- aimeos/ai-controller-frontend (Packagist) Vendor— Affected 2023.04.1 to before 2023.10.9 Fixed in 2023.10.9 Patch available GHSA-rw3j-574h-mrcq
- aimeos/ai-controller-frontend (Packagist) Vendor— Affected 2022.04.1 to before 2022.10.8 Fixed in 2022.10.8 Patch available GHSA-rw3j-574h-mrcq
- aimeos/ai-controller-frontend (Packagist) Vendor— Affected 2021.04.1 to before 2021.10.8 Fixed in 2021.10.8 Patch available GHSA-rw3j-574h-mrcq
- aimeos/ai-controller-frontend (Packagist) Vendor— Affected before 2020.10.15 Fixed in 2020.10.15 Patch available GHSA-rw3j-574h-mrcq
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aimeos:aimeos_frontend_controller:*:*:*:*:*:*:*:* | before 2020.10.15; 2021.04.1 to before 2021.10.8; 2022.04.1 to before 2022.10.8; 2023.04.1 to before 2023.10.9 | Vulnerable | aimeos |
| cpe:2.3:a:aimeos:aimeos_frontend_controller:2024.04.1:*:*:*:*:*:*:* | 2024.04.1 | Vulnerable | aimeos |
- cpe:2.3:a:aimeos:aimeos_frontend_controller:*:*:*:*:*:*:*:* Versions before 2020.10.15; 2021.04.1 to before 2021.10.8; 2022.04.1 to before 2022.10.8; 2023.04.1 to before 2023.10.9 Vulnerable ·aimeos
- cpe:2.3:a:aimeos:aimeos_frontend_controller:2024.04.1:*:*:*:*:*:*:* Versions 2024.04.1 Vulnerable ·aimeos
Remediation
- Fix · CNA ai-controller-frontend (aimeos) Fixed in 2023.10.9, 2022.10.8, 2021.10.8, 2020.10.15
- Fix · GHSA-rw3j-574h-mrcq aimeos/ai-controller-frontend (Packagist) Fixed in 2024.04.2 Advisory →
- Fix · GHSA-rw3j-574h-mrcq aimeos/ai-controller-frontend (Packagist) Fixed in 2023.10.9 Advisory →
- Fix · GHSA-rw3j-574h-mrcq aimeos/ai-controller-frontend (Packagist) Fixed in 2022.10.8 Advisory →
- Fix · GHSA-rw3j-574h-mrcq aimeos/ai-controller-frontend (Packagist) Fixed in 2021.10.8 Advisory →
- Fix · GHSA-rw3j-574h-mrcq aimeos/ai-controller-frontend (Packagist) Fixed in 2020.10.15 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-39319
- 2026-10-03 Alias added: GHSA-rw3j-574h-mrcq
References
Patch 10
- https://github.com/aimeos/ai-controller-frontend/commit/2ad5c062a629af374da470a319914c321c9bfee2
- https://github.com/aimeos/ai-controller-frontend/commit/53eebdc51fae34440dfd768a7811c169c7779aa9
- https://github.com/aimeos/ai-controller-frontend/commit/5833db6d18a889b94dc036dfb84b6f5cca73fbac
- https://github.com/aimeos/ai-controller-frontend/commit/6ea6b82f5a1fc18c574cb6f97225930d139b14a5
- https://github.com/aimeos/ai-controller-frontend/commit/700da5ea2b622724b68c8684346bf74ac3bbca9b
- https://github.com/aimeos/ai-controller-frontend/commit/7c93139f86eff9ec26b117a8918e06ce6cc0000f
- https://github.com/aimeos/ai-controller-frontend/commit/ae7baa3f2fbf594c2c1e4b1aae83364a84b241a6
- https://github.com/aimeos/ai-controller-frontend/commit/cd8c95aa4663f54bd66a69c5952f2e42405426f3
- https://github.com/aimeos/ai-controller-frontend/commit/d4eac06f3a25330c089d8be4397f2ab1936dd9bb
- https://github.com/aimeos/ai-controller-frontend/commit/f7c6a9ce2a6f5a9ad4af31313508870a78398f85
Advisory 2
More Aimeos Frontend Controller vulnerabilities
- TI-2024-26281 aimeos/ai-controller-frontend doesn't reset payment status in basket CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-39319 · CVE Program
- CVE-2024-39319 · NVD
- FIRST EPSS
- GHSA-rw3j-574h-mrcq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences