What’s Vulnerable › Vulnerabilities

CVE-2024-39319: aimeos/ai-controller-frontend has IDOR vulnerability in account profile page

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-26 · updated 2026-06-17
• Weakness: CWE-639

Description

aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.

Affected products

• aimeos ai-controller-frontend: before 2020.10.15; from 2021.04.1 before 2021.10.8; from 2022.04.1 before 2022.10.8; from 2023.04.1 before 2023.10.9; 2024.04.1 — fixed in 2020.10.15, 2021.10.8, 2022.10.8, 2023.10.9

How to fix

Upgrade to a fixed version: aimeos ai-controller-frontend 2020.10.15, 2021.10.8, 2022.10.8, 2023.10.9. Check the vendor advisory for mitigations.

References

• https://github.com/aimeos/ai-controller-frontend/commit/2ad5c062a629af374da470a319914c321c9bfee2
• https://github.com/aimeos/ai-controller-frontend/commit/53eebdc51fae34440dfd768a7811c169c7779aa9
• https://github.com/aimeos/ai-controller-frontend/commit/5833db6d18a889b94dc036dfb84b6f5cca73fbac
• https://github.com/aimeos/ai-controller-frontend/commit/6ea6b82f5a1fc18c574cb6f97225930d139b14a5
• https://github.com/aimeos/ai-controller-frontend/commit/700da5ea2b622724b68c8684346bf74ac3bbca9b
• https://github.com/aimeos/ai-controller-frontend/commit/7c93139f86eff9ec26b117a8918e06ce6cc0000f
• https://github.com/aimeos/ai-controller-frontend/commit/ae7baa3f2fbf594c2c1e4b1aae83364a84b241a6
• https://github.com/aimeos/ai-controller-frontend/commit/cd8c95aa4663f54bd66a69c5952f2e42405426f3
• https://github.com/aimeos/ai-controller-frontend/commit/d4eac06f3a25330c089d8be4397f2ab1936dd9bb
• https://github.com/aimeos/ai-controller-frontend/commit/f7c6a9ce2a6f5a9ad4af31313508870a78398f85
• https://github.com/aimeos/ai-controller-frontend/security/advisories/GHSA-rw3j-574h-mrcq

Get alerted when CVE-2024-39319 or the next vulnerability affects your stack