Denial of Service Vulnerability in ai-admin-graphql Package
Summary
CVE-2024-47173: ai-admin-graphql has a Denial of service vulnerability in SaaS and marketplace setups. Affects aimeos/ai-admin-graphql versions >= 2024.04.1, < 2024.07.2. Fixed in 2024.07.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ai-admin-graphql package is part of the Aimeos framework, which is designed for creating e-commerce applications. It provides a GraphQL interface for managing administrative tasks within SaaS and marketplace setups. This package is widely used for its flexibility and scalability, allowing developers to build robust online stores. However, certain versions of this package are susceptible to a denial of service vulnerability that can impact the availability of applications using it.
Vulnerability Detail
The vulnerability arises in all SaaS and marketplace setups using Aimeos versions from 2024.04 up to 2024.07.1. It can be exploited by attackers to launch a denial of service attack, potentially causing the application to become unresponsive or crash. This issue is classified under CWE-270, indicating a risk of unauthorized access or service disruption. The ramifications of this vulnerability can lead to significant downtime and loss of service for users, affecting business operations and customer trust.
How To Fix
Minimum fixed version
2024.07.2
This is the first release that contains the fix.
composer require aimeos/ai-admin-graphql:2024.07.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing rate limiting on your application to mitigate the impact of potential denial of service attacks. This can help control the number of requests made to your server and reduce the likelihood of service disruption.
Conclusion
The ai-admin-graphql package has a significant denial of service vulnerability that affects various SaaS and marketplace setups. It is crucial for developers to update to the patched version to ensure the security and availability of their applications. Implementing workarounds and utilizing monitoring tools like Vulert can further enhance the security posture of your software.
See every vulnerability recorded for aimeos/ai-admin-graphql →
FAQ
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
All versions from 2024.04 up to 2024.07.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to denial of service, causing your application to become unresponsive or crash, which can disrupt business operations.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your composer.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for aimeos/ai-admin-graphql.
