Aimeos vulnerabilities
We track 3 vulnerabilities in Aimeos products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 2, 2024.
Latest Aimeos vulnerabilities
- 7.1 High severity
ai-admin-graphql: Incorrect Authorization
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in
- 8.8 High severity
ai-client-html: Debug Messages Revealing Unnecessary Information
ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.
- 7.2 High severity
aimeos-core: External Control of File Name or Path
Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the co