CVE-2024-39323highCWE-1220CWE-863

CVE-2024-39323: high-severity vulnerability in aimeos ai-admin-graphql

aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account

Published · Updated

Follow this CVE+ Monitor ai-admin-graphql+ Monitor aimeos/ai-admin-graphql

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.4%
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Affected products
aimeos · ai-admin-graphql
Related CVEs — aimeos ai-admin-graphql

In the same product, most dangerous first.

CVE-2024-39324LOWaimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own servicesEPSS 0.4%CVE-2024-47173MEDIUMAimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setupsEPSS 0.4%