aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
Impact
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 2022.04.1 before 2022.10.10Ecosystem versions | 2022.10.10 |
| From 2023.04.1 before 2023.10.6Ecosystem versions | 2023.10.6 |
| From 2024.04.1 before 2024.04.6Ecosystem versions | 2024.04.6 |
Version evidence: OSV · GHSA-vc7j-99jw-jrqm
View original version evidence (24 explicit versions)
Original source description
aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.
References
- Security advisory github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-vc7j-99jw-jrqm
- Security advisory nvd.nist.gov/vuln/detail/CVE-2024-39323
- Patch github.com/aimeos/ai-admin-graphql/commit/2d89d98cdcad880a9244b50736b08c1a171379ca
- Patch github.com/aimeos/ai-admin-graphql/commit/54d6b7cf4530cb3b95f52775c24056c48e6d26e9
- Patch github.com/aimeos/ai-admin-graphql/commit/787028de0a3ecbf3e9f63ab1454eac99ce7693a9
- Source reference github.com/aimeos/ai-admin-graphql