aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records
Priority LOW 25CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00481 41st percentileScored 2026-11-07
Fix Fixed ai-admin-jsonadm (aimeos): 2023.10.4, 2022.10.3, 2021.10.6 +1aimeos/ai-admin-jsonadm (Packagist): 2024.04.2, 2023.10.4, 2022.10.3 +2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aimeos | ai-admin-jsonadm | = 2024.04.1; 2023.04.1 to before 2023.10.4; 2022.04.1 to before 2022.10.3; 2021.04.1 to before 2021.10.6; before 2020.10.13 | 2023.10.4, 2022.10.3, 2021.10.6, 2020.10.13 | Patch available | CNA |
| — | aimeos/ai-admin-jsonadm (Packagist) | 2024.04.1 to before 2024.04.2 | 2024.04.2 | Patch available | GHSA-8fj2-587w-5whr |
| — | aimeos/ai-admin-jsonadm (Packagist) | 2023.04.1 to before 2023.10.4 | 2023.10.4 | Patch available | GHSA-8fj2-587w-5whr |
| — | aimeos/ai-admin-jsonadm (Packagist) | 2022.04.1 to before 2022.10.3 | 2022.10.3 | Patch available | GHSA-8fj2-587w-5whr |
| — | aimeos/ai-admin-jsonadm (Packagist) | 2021.04.1 to before 2021.10.6 | 2021.10.6 | Patch available | GHSA-8fj2-587w-5whr |
| — | aimeos/ai-admin-jsonadm (Packagist) | before 2020.10.13 | 2020.10.13 | Patch available | GHSA-8fj2-587w-5whr |
- ai-admin-jsonadm Vendoraimeos Affected = 2024.04.1; 2023.04.1 to before 2023.10.4; 2022.04.1 to before 2022.10.3; 2021.04.1 to before 2021.10.6; before 2020.10.13 Fixed in 2023.10.4, 2022.10.3, 2021.10.6, 2020.10.13 Patch available CNA
- aimeos/ai-admin-jsonadm (Packagist) Vendor— Affected 2024.04.1 to before 2024.04.2 Fixed in 2024.04.2 Patch available GHSA-8fj2-587w-5whr
- aimeos/ai-admin-jsonadm (Packagist) Vendor— Affected 2023.04.1 to before 2023.10.4 Fixed in 2023.10.4 Patch available GHSA-8fj2-587w-5whr
- aimeos/ai-admin-jsonadm (Packagist) Vendor— Affected 2022.04.1 to before 2022.10.3 Fixed in 2022.10.3 Patch available GHSA-8fj2-587w-5whr
- aimeos/ai-admin-jsonadm (Packagist) Vendor— Affected 2021.04.1 to before 2021.10.6 Fixed in 2021.10.6 Patch available GHSA-8fj2-587w-5whr
- aimeos/ai-admin-jsonadm (Packagist) Vendor— Affected before 2020.10.13 Fixed in 2020.10.13 Patch available GHSA-8fj2-587w-5whr
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aimeos_project:ai-controller-frontend:*:*:*:*:*:*:*:* | before 2020.10.13; 2021.04.1 to before 2021.10.6; 2022.04.1 to before 2022.10.3; 2023.04.1 to before 2023.10.4 | Vulnerable | Aimeos Project |
| cpe:2.3:a:aimeos_project:ai-controller-frontend:2024.04.1:*:*:*:*:*:*:* | 2024.04.1 | Vulnerable | Aimeos Project |
- cpe:2.3:a:aimeos_project:ai-controller-frontend:*:*:*:*:*:*:*:* Versions before 2020.10.13; 2021.04.1 to before 2021.10.6; 2022.04.1 to before 2022.10.3; 2023.04.1 to before 2023.10.4 Vulnerable ·Aimeos Project
- cpe:2.3:a:aimeos_project:ai-controller-frontend:2024.04.1:*:*:*:*:*:*:* Versions 2024.04.1 Vulnerable ·Aimeos Project
Remediation
- Fix · CNA ai-admin-jsonadm (aimeos) Fixed in 2023.10.4, 2022.10.3, 2021.10.6, 2020.10.13
- Fix · GHSA-8fj2-587w-5whr aimeos/ai-admin-jsonadm (Packagist) Fixed in 2024.04.2 Advisory →
- Fix · GHSA-8fj2-587w-5whr aimeos/ai-admin-jsonadm (Packagist) Fixed in 2023.10.4 Advisory →
- Fix · GHSA-8fj2-587w-5whr aimeos/ai-admin-jsonadm (Packagist) Fixed in 2022.10.3 Advisory →
- Fix · GHSA-8fj2-587w-5whr aimeos/ai-admin-jsonadm (Packagist) Fixed in 2021.10.6 Advisory →
- Fix · GHSA-8fj2-587w-5whr aimeos/ai-admin-jsonadm (Packagist) Fixed in 2020.10.13 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-39322
- 2026-10-03 Alias added: GHSA-8fj2-587w-5whr
References
Patch 5
- https://github.com/aimeos/ai-admin-jsonadm/commit/02a063fbd616d4e0a5aaf89f1642a856aa5ac5a5
- https://github.com/aimeos/ai-admin-jsonadm/commit/16d013d0e28cecd19781f434d83fabebcc78cdc2
- https://github.com/aimeos/ai-admin-jsonadm/commit/4c966e02bd52589c3c9382777cfe170eddf17b00
- https://github.com/aimeos/ai-admin-jsonadm/commit/640954243ce85c2c303a00dd6481ed39b3d218fb
- https://github.com/aimeos/ai-admin-jsonadm/commit/7d1c05e8368b0a6419820fe402deac9960500026
Advisory 2
More aimeos vulnerabilities
- TI-2021-22379 Aimeos Laravel ecommerce platform 2021.10 LTS - 'sort' SQL injection CVSS 4.0HIGH 8.8
- TI-2024-25751 Aimeos HTML client may potentially reveal sensitive information in error log CVSS 3.1HIGH 8.8
- TI-2024-24807 Aimeos Core remote code execution in web server context CVSS 3.1HIGH 7.2
- TI-2025-40895 Aimeos GrapesJS CMS extension possible stores XSS exploitable by authenticated editors CVSS 3.1HIGH 7.7
- TI-2024-26279 aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account CVSS 3.1HIGH 7.1
- TI-2024-26275 aimeos/ai-controller-frontend has IDOR vulnerability in account profile page CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-39322 · CVE Program
- CVE-2024-39322 · NVD
- FIRST EPSS
- GHSA-8fj2-587w-5whr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences