{"id":"GHSA-rhc2-23c2-ww7c","aliases":["CVE-2024-37295"],"title":"Remote code execution in web server context","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Impact\nUser with administrative privileges and upload files that look like images but contain PHP code which can then be executed in the context of the web server.\n","severity":"high","score":7.2,"published":"2024-06-05T13:29:47.000Z","modified":"2024-06-11T21:14:02.296Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"aimeos/aimeos-core","sources":[{"name":"OSV · GHSA-rhc2-23c2-ww7c","url":"https://osv.dev/vulnerability/GHSA-rhc2-23c2-ww7c"}],"ranges":[{"events":[{"introduced":"2024.04.1"},{"fixed":"2024.04.5"}],"type":"ECOSYSTEM"}],"versions":["2024.04.1","2024.04.2","2024.04.3","2024.04.4"],"fixed":["2024.04.5"]}],"sourceAffected":[],"references":["https://github.com/aimeos/aimeos-core/security/advisories/GHSA-rhc2-23c2-ww7c","https://nvd.nist.gov/vuln/detail/CVE-2024-37295","https://github.com/aimeos/aimeos-core"],"sources":[{"name":"OSV","id":"GHSA-rhc2-23c2-ww7c","modified":"2024-06-11T21:14:02.296786Z","url":"https://osv.dev/vulnerability/GHSA-rhc2-23c2-ww7c"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T23:45:31.121Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}