aimeos/ai-controller-frontend doesn't reset payment status in basket
Priority LOW 24CWE-841Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Fix Fixed ai-controller-frontend (aimeos): 2023.10.9, 2022.10.8, 2021.10.8 +1aimeos/ai-controller-frontend (Packagist): 2023.10.9, 2022.10.8, 2021.10.8 +1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| aimeos | ai-controller-frontend | = 2024.04.1; 2023.04.1 to before 2023.10.9; 2022.04.1 to before 2022.10.8; 2021.04.1 to before 2021.10.8; before 2020.10.15 | 2023.10.9, 2022.10.8, 2021.10.8, 2020.10.15 | Patch available | CNA |
| — | aimeos/ai-controller-frontend (Packagist) | 2023.04.1 to before 2023.10.9 | 2023.10.9 | Patch available | GHSA-m9gv-6p22-qgmj |
| — | aimeos/ai-controller-frontend (Packagist) | 2022.04.1 to before 2022.10.8 | 2022.10.8 | Patch available | GHSA-m9gv-6p22-qgmj |
| — | aimeos/ai-controller-frontend (Packagist) | 2021.04.1 to before 2021.10.8 | 2021.10.8 | Patch available | GHSA-m9gv-6p22-qgmj |
| — | aimeos/ai-controller-frontend (Packagist) | before 2020.10.15 | 2020.10.15 | Patch available | GHSA-m9gv-6p22-qgmj |
- ai-controller-frontend Vendoraimeos Affected = 2024.04.1; 2023.04.1 to before 2023.10.9; 2022.04.1 to before 2022.10.8; 2021.04.1 to before 2021.10.8; before 2020.10.15 Fixed in 2023.10.9, 2022.10.8, 2021.10.8, 2020.10.15 Patch available CNA
- aimeos/ai-controller-frontend (Packagist) Vendor— Affected 2023.04.1 to before 2023.10.9 Fixed in 2023.10.9 Patch available GHSA-m9gv-6p22-qgmj
- aimeos/ai-controller-frontend (Packagist) Vendor— Affected 2022.04.1 to before 2022.10.8 Fixed in 2022.10.8 Patch available GHSA-m9gv-6p22-qgmj
- aimeos/ai-controller-frontend (Packagist) Vendor— Affected 2021.04.1 to before 2021.10.8 Fixed in 2021.10.8 Patch available GHSA-m9gv-6p22-qgmj
- aimeos/ai-controller-frontend (Packagist) Vendor— Affected before 2020.10.15 Fixed in 2020.10.15 Patch available GHSA-m9gv-6p22-qgmj
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:aimeos:aimeos_frontend_controller:*:*:*:*:*:*:*:* | before 2020.10.15; 2021.04.1 to before 2021.10.8; 2022.04.1 to before 2022.10.8; 2023.04.1 to before 2023.10.9 | Vulnerable | aimeos |
| cpe:2.3:a:aimeos:aimeos_frontend_controller:2024.04.1:*:*:*:*:*:*:* | 2024.04.1 | Vulnerable | aimeos |
- cpe:2.3:a:aimeos:aimeos_frontend_controller:*:*:*:*:*:*:*:* Versions before 2020.10.15; 2021.04.1 to before 2021.10.8; 2022.04.1 to before 2022.10.8; 2023.04.1 to before 2023.10.9 Vulnerable ·aimeos
- cpe:2.3:a:aimeos:aimeos_frontend_controller:2024.04.1:*:*:*:*:*:*:* Versions 2024.04.1 Vulnerable ·aimeos
Remediation
- Fix · CNA ai-controller-frontend (aimeos) Fixed in 2023.10.9, 2022.10.8, 2021.10.8, 2020.10.15
- Fix · GHSA-m9gv-6p22-qgmj aimeos/ai-controller-frontend (Packagist) Fixed in 2023.10.9 Advisory →
- Fix · GHSA-m9gv-6p22-qgmj aimeos/ai-controller-frontend (Packagist) Fixed in 2022.10.8 Advisory →
- Fix · GHSA-m9gv-6p22-qgmj aimeos/ai-controller-frontend (Packagist) Fixed in 2021.10.8 Advisory →
- Fix · GHSA-m9gv-6p22-qgmj aimeos/ai-controller-frontend (Packagist) Fixed in 2020.10.15 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-39325
- 2026-10-03 Alias added: GHSA-m9gv-6p22-qgmj
References
Patch 5
- https://github.com/aimeos/ai-controller-frontend/commit/16b8837d2466e3665b3c826ce87934b01a847268
- https://github.com/aimeos/ai-controller-frontend/commit/24a57001e56759d1582d2a0080fc1ca3ba328630
- https://github.com/aimeos/ai-controller-frontend/commit/28549808e0f6432a34cd3fb95556deeb86ca276d
- https://github.com/aimeos/ai-controller-frontend/commit/b1960c0b6e5ee93111a5360c9ce949b3e7528cf7
- https://github.com/aimeos/ai-controller-frontend/commit/dafa072783bb692f111ed092d9d2932c113eb855
Advisory 2
More Aimeos Frontend Controller vulnerabilities
- TI-2024-26275 aimeos/ai-controller-frontend has IDOR vulnerability in account profile page CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-39325 · CVE Program
- CVE-2024-39325 · NVD
- FIRST EPSS
- GHSA-m9gv-6p22-qgmj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences