CVE-2024-37294: Aimeos denial of service vulnerability in SaaS and marketplace setups

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-11 · updated 2026-06-17
Weakness: CWE-270

Description

Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.

Affected products

aimeos-core: before 2024.04.7; before 2023.10.17; before 2022.10.17 — fixed in 2022.10.17, 2023.10.17, 2024.04.7

How to fix

Upgrade to a fixed version: aimeos-core 2022.10.17, 2023.10.17, 2024.04.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-37294 or the next vulnerability affects your stack