Aimeos HTML client may potentially reveal sensitive information in error log
The advisory, in context
Impact
Debug information can reveal sensitive information from environment variables in error log
Affected platform
Laravel environments with multi-vendor setups and admin access for the vendors
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2024.04.1 before 2024.04.7
Fixed in 2024.04.7
6 explicitly affected versions
2024.04.1, 2024.04.2, 2024.04.3, 2024.04.4, 2024.04.5, 2024.04.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2024.04.1"
},
{
"fixed": "2024.04.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2024.04.1",
"2024.04.2",
"2024.04.3",
"2024.04.4",
"2024.04.5",
"2024.04.6"
]
}From 2023.04.1 before 2023.10.15
Fixed in 2023.10.15
24 explicitly affected versions
2023.04.1, 2023.04.2, 2023.04.3, 2023.04.4, 2023.07.1, 2023.07.2, 2023.07.3, 2023.07.4, 2023.07.5, 2023.07.6, 2023.10.1, 2023.10.10, 2023.10.11, 2023.10.12, 2023.10.13, 2023.10.14, 2023.10.2, 2023.10.3, 2023.10.4, 2023.10.5, 2023.10.6, 2023.10.7, 2023.10.8, 2023.10.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2023.04.1"
},
{
"fixed": "2023.10.15"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2023.04.1",
"2023.04.2",
"2023.04.3",
"2023.04.4",
"2023.07.1",
"2023.07.2",
"2023.07.3",
"2023.07.4",
"2023.07.5",
"2023.07.6",
"2023.10.1",
"2023.10.10",
"2023.10.11",
"2023.10.12",
"2023.10.13",
"2023.10.14",
"2023.10.2",
"2023.10.3",
"2023.10.4",
"2023.10.5",
"2023.10.6",
"2023.10.7",
"2023.10.8",
"2023.10.9"
]
}From 2022.04.1 before 2022.10.13
Fixed in 2022.10.13
31 explicitly affected versions
2022.04.1, 2022.04.10, 2022.04.11, 2022.04.12, 2022.04.13, 2022.04.14, 2022.04.15, 2022.04.2, 2022.04.3, 2022.04.4, 2022.04.5, 2022.04.6, 2022.04.7, 2022.04.8, 2022.04.9, 2022.07.1, 2022.07.2, 2022.07.3, 2022.07.4, 2022.10.1, 2022.10.10, 2022.10.11, 2022.10.12, 2022.10.2, 2022.10.3, 2022.10.4, 2022.10.5, 2022.10.6, 2022.10.7, 2022.10.8, 2022.10.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2022.04.1"
},
{
"fixed": "2022.10.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2022.04.1",
"2022.04.10",
"2022.04.11",
"2022.04.12",
"2022.04.13",
"2022.04.14",
"2022.04.15",
"2022.04.2",
"2022.04.3",
"2022.04.4",
"2022.04.5",
"2022.04.6",
"2022.04.7",
"2022.04.8",
"2022.04.9",
"2022.07.1",
"2022.07.2",
"2022.07.3",
"2022.07.4",
"2022.10.1",
"2022.10.10",
"2022.10.11",
"2022.10.12",
"2022.10.2",
"2022.10.3",
"2022.10.4",
"2022.10.5",
"2022.10.6",
"2022.10.7",
"2022.10.8",
"2022.10.9"
]
}From 2021.10.1 before 2021.10.22
Fixed in 2021.10.22
21 explicitly affected versions
2021.10.1, 2021.10.10, 2021.10.11, 2021.10.12, 2021.10.13, 2021.10.14, 2021.10.15, 2021.10.16, 2021.10.17, 2021.10.18, 2021.10.19, 2021.10.2, 2021.10.20, 2021.10.21, 2021.10.3, 2021.10.4, 2021.10.5, 2021.10.6, 2021.10.7, 2021.10.8, 2021.10.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2021.10.1"
},
{
"fixed": "2021.10.22"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2021.10.1",
"2021.10.10",
"2021.10.11",
"2021.10.12",
"2021.10.13",
"2021.10.14",
"2021.10.15",
"2021.10.16",
"2021.10.17",
"2021.10.18",
"2021.10.19",
"2021.10.2",
"2021.10.20",
"2021.10.21",
"2021.10.3",
"2021.10.4",
"2021.10.5",
"2021.10.6",
"2021.10.7",
"2021.10.8",
"2021.10.9"
]
}