Digital products download without proper payment status check
The advisory, in context
Impact
Digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed.
Patches
New versions for the Aimeos HTML client 2020-2024 are available
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2024.04.1 before 2024.04.5
Fixed in 2024.04.5
4 explicitly affected versions
2024.04.1, 2024.04.2, 2024.04.3, 2024.04.4
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2024.04.1"
},
{
"fixed": "2024.04.5"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2024.04.1",
"2024.04.2",
"2024.04.3",
"2024.04.4"
]
}From 2023.04.1 before 2023.10.14
Fixed in 2023.10.14
23 explicitly affected versions
2023.04.1, 2023.04.2, 2023.04.3, 2023.04.4, 2023.07.1, 2023.07.2, 2023.07.3, 2023.07.4, 2023.07.5, 2023.07.6, 2023.10.1, 2023.10.10, 2023.10.11, 2023.10.12, 2023.10.13, 2023.10.2, 2023.10.3, 2023.10.4, 2023.10.5, 2023.10.6, 2023.10.7, 2023.10.8, 2023.10.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2023.04.1"
},
{
"fixed": "2023.10.14"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2023.04.1",
"2023.04.2",
"2023.04.3",
"2023.04.4",
"2023.07.1",
"2023.07.2",
"2023.07.3",
"2023.07.4",
"2023.07.5",
"2023.07.6",
"2023.10.1",
"2023.10.10",
"2023.10.11",
"2023.10.12",
"2023.10.13",
"2023.10.2",
"2023.10.3",
"2023.10.4",
"2023.10.5",
"2023.10.6",
"2023.10.7",
"2023.10.8",
"2023.10.9"
]
}From 2022.04.1 before 2022.10.12
Fixed in 2022.10.12
30 explicitly affected versions
2022.04.1, 2022.04.10, 2022.04.11, 2022.04.12, 2022.04.13, 2022.04.14, 2022.04.15, 2022.04.2, 2022.04.3, 2022.04.4, 2022.04.5, 2022.04.6, 2022.04.7, 2022.04.8, 2022.04.9, 2022.07.1, 2022.07.2, 2022.07.3, 2022.07.4, 2022.10.1, 2022.10.10, 2022.10.11, 2022.10.2, 2022.10.3, 2022.10.4, 2022.10.5, 2022.10.6, 2022.10.7, 2022.10.8, 2022.10.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2022.04.1"
},
{
"fixed": "2022.10.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2022.04.1",
"2022.04.10",
"2022.04.11",
"2022.04.12",
"2022.04.13",
"2022.04.14",
"2022.04.15",
"2022.04.2",
"2022.04.3",
"2022.04.4",
"2022.04.5",
"2022.04.6",
"2022.04.7",
"2022.04.8",
"2022.04.9",
"2022.07.1",
"2022.07.2",
"2022.07.3",
"2022.07.4",
"2022.10.1",
"2022.10.10",
"2022.10.11",
"2022.10.2",
"2022.10.3",
"2022.10.4",
"2022.10.5",
"2022.10.6",
"2022.10.7",
"2022.10.8",
"2022.10.9"
]
}From 2021.04.1 before 2021.10.21
Fixed in 2021.10.21
47 explicitly affected versions
2021.04.1, 2021.04.10, 2021.04.11, 2021.04.12, 2021.04.13, 2021.04.14, 2021.04.2, 2021.04.3, 2021.04.4, 2021.04.5, 2021.04.6, 2021.04.7, 2021.04.8, 2021.04.9, 2021.07.1, 2021.07.10, 2021.07.11, 2021.07.12, 2021.07.13, 2021.07.2, 2021.07.3, 2021.07.4, 2021.07.5, 2021.07.6, 2021.07.7, 2021.07.8, 2021.07.9, 2021.10.1, 2021.10.10, 2021.10.11, 2021.10.12, 2021.10.13, 2021.10.14, 2021.10.15, 2021.10.16, 2021.10.17, 2021.10.18, 2021.10.19, 2021.10.2, 2021.10.20, 2021.10.3, 2021.10.4, 2021.10.5, 2021.10.6, 2021.10.7, 2021.10.8, 2021.10.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2021.04.1"
},
{
"fixed": "2021.10.21"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2021.04.1",
"2021.04.10",
"2021.04.11",
"2021.04.12",
"2021.04.13",
"2021.04.14",
"2021.04.2",
"2021.04.3",
"2021.04.4",
"2021.04.5",
"2021.04.6",
"2021.04.7",
"2021.04.8",
"2021.04.9",
"2021.07.1",
"2021.07.10",
"2021.07.11",
"2021.07.12",
"2021.07.13",
"2021.07.2",
"2021.07.3",
"2021.07.4",
"2021.07.5",
"2021.07.6",
"2021.07.7",
"2021.07.8",
"2021.07.9",
"2021.10.1",
"2021.10.10",
"2021.10.11",
"2021.10.12",
"2021.10.13",
"2021.10.14",
"2021.10.15",
"2021.10.16",
"2021.10.17",
"2021.10.18",
"2021.10.19",
"2021.10.2",
"2021.10.20",
"2021.10.3",
"2021.10.4",
"2021.10.5",
"2021.10.6",
"2021.10.7",
"2021.10.8",
"2021.10.9"
]
}From 2020.04.1 before 2020.10.27
Fixed in 2020.10.27
39 explicitly affected versions
2020.04.1, 2020.04.2, 2020.04.3, 2020.04.4, 2020.04.5, 2020.04.6, 2020.04.7, 2020.07.1, 2020.07.2, 2020.07.3, 2020.07.4, 2020.07.5, 2020.07.6, 2020.10.1, 2020.10.10, 2020.10.11, 2020.10.12, 2020.10.13, 2020.10.14, 2020.10.15, 2020.10.16, 2020.10.17, 2020.10.18, 2020.10.19, 2020.10.2, 2020.10.20, 2020.10.21, 2020.10.22, 2020.10.23, 2020.10.24, 2020.10.25, 2020.10.26, 2020.10.3, 2020.10.4, 2020.10.5, 2020.10.6, 2020.10.7, 2020.10.8, 2020.10.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2020.04.1"
},
{
"fixed": "2020.10.27"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2020.04.1",
"2020.04.2",
"2020.04.3",
"2020.04.4",
"2020.04.5",
"2020.04.6",
"2020.04.7",
"2020.07.1",
"2020.07.2",
"2020.07.3",
"2020.07.4",
"2020.07.5",
"2020.07.6",
"2020.10.1",
"2020.10.10",
"2020.10.11",
"2020.10.12",
"2020.10.13",
"2020.10.14",
"2020.10.15",
"2020.10.16",
"2020.10.17",
"2020.10.18",
"2020.10.19",
"2020.10.2",
"2020.10.20",
"2020.10.21",
"2020.10.22",
"2020.10.23",
"2020.10.24",
"2020.10.25",
"2020.10.26",
"2020.10.3",
"2020.10.4",
"2020.10.5",
"2020.10.6",
"2020.10.7",
"2020.10.8",
"2020.10.9"
]
}References
- https://github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7
- https://nvd.nist.gov/vuln/detail/CVE-2024-37296
- https://github.com/aimeos/ai-client-html/commit/12d8aad1a373bf9d350872501adec3e222164f83
- https://github.com/aimeos/ai-client-html/commit/5a7249769142b3ce70959ab1fb70c7e7c251e214
- https://github.com/aimeos/ai-client-html/commit/6460ffe8f4929d864164aa96c5b49eca5326d975
- https://github.com/aimeos/ai-client-html/commit/7f01d2f4fbc67f5231fd84adeb835d28252b8409
- https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99346b561cea515c5f0
- https://github.com/aimeos/ai-client-html