Skip to main content

Authorization Bypass Through User-Controlled Key

CVE-2024-39319

Medium
6.9/10

Summary

The aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. In versions 2018.04.1 through 2020.10.14, 2021.04.1 through 2021.10.7, 2022.04.1 through 2022.10.7, 2023.04.1 through 2023.10.8, and 2024.04.1, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-639 - Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References

Advisory Timeline

  • Published