Digital products download without proper payment status check in aimeos/ai-client-html
Summary
CVE-2024-37296: Digital products download without proper payment status check. Affects aimeos/ai-client-html across 5 version ranges.
>= 2020.04.1, < 2020.10.27
>= 2021.04.1, < 2021.10.21
>= 2022.04.1, < 2022.10.12
>= 2023.04.1, < 2023.10.14
>= 2024.04.1, < 2024.04.5
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The aimeos/ai-client-html package is a component of the Aimeos HTML client, which is used for selling digital products in online shops. It provides functionality for managing and processing payments for digital downloads. However, a vulnerability has been discovered in the package that allows digital downloads to be accessed without proper payment status checks. This means that even if the payment for a digital product fails, it can still be downloaded by users. This vulnerability can potentially lead to financial losses for online shops and unauthorized access to digital content.
Vulnerability Detail
The vulnerability in aimeos/ai-client-html allows digital downloads to be accessed without valid payment status checks. This means that even if the payment for a digital product fails, it can still be downloaded by users. The impact of this vulnerability is that online shops may suffer financial losses due to unauthorized access to digital content. The vulnerability has a CVSS score of 5.3, indicating a moderate severity level. The affected versions of the package range from 2020.04.1 to 2024.04.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2020.04.1, < 2020.10.272020.10.27composer require aimeos/ai-client-html:2020.10.27 -
>= 2021.04.1, < 2021.10.212021.10.21composer require aimeos/ai-client-html:2021.10.21 -
>= 2022.04.1, < 2022.10.122022.10.12composer require aimeos/ai-client-html:2022.10.12 -
>= 2023.04.1, < 2023.10.142023.10.14composer require aimeos/ai-client-html:2023.10.14 -
>= 2024.04.1, < 2024.04.52024.04.5composer require aimeos/ai-client-html:2024.04.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update the package to the fixed version to mitigate the risk.
Conclusion
The aimeos/ai-client-html package is vulnerable to a moderate severity issue that allows digital downloads to be accessed without proper payment status checks. To mitigate the risk, it is important to update the package to version 2024.04.5 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aimeos/ai-client-html →
FAQ
The aimeos/ai-client-html package is a component of the Aimeos HTML client, which is used for selling digital products in online shops.
The impact of this vulnerability is that digital downloads can be accessed without valid payment status checks, potentially leading to financial losses for online shops and unauthorized access to digital content.
The severity level of this vulnerability is moderate, with a CVSS score of 5.3.
To fix this vulnerability, it is recommended to update the aimeos/ai-client-html package to version 2024.04.5 or later.
No, there is no known workaround for this vulnerability. It is necessary to update the package to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for aimeos/ai-client-html.
