CVE-2024-37296

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-37296
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37296.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-37296
Aliases
Published
2024-06-11T14:43:39Z
Modified
2025-10-22T18:42:45.656639Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Aimeos HTML client vulnerable to digital products download without proper payment status check
Details

The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-841",
        "CWE-862"
    ]
}
References

Affected packages

Git / github.com/aimeos/ai-client-html

Affected ranges

Type
GIT
Repo
https://github.com/aimeos/ai-client-html
Events
Introduced
67364361d2e146023cddd73e9ecb7308a37d02dd
Fixed
12d8aad1a373bf9d350872501adec3e222164f83
Type
GIT
Repo
https://github.com/aimeos/ai-client-html
Events
Introduced
495cbe5a5238f176cc9c7f3f7cb1bdeda0346f7a
Fixed
6460ffe8f4929d864164aa96c5b49eca5326d975
Type
GIT
Repo
https://github.com/aimeos/ai-client-html
Events
Introduced
28c93f3ab1fe8e16e5d20ae183e0e3094c3239bc
Fixed
fc611ff9a57e421d0ad9d99346b561cea515c5f0
Type
GIT
Repo
https://github.com/aimeos/ai-client-html
Events
Introduced
b2a8f65540ad719fb9e6cbaa6d0f33d7053db8e3
Fixed
ec632ca91d943ba20901f2565b3a686bed7b5f9e
Type
GIT
Repo
https://github.com/aimeos/ai-client-html
Events
Introduced
539cca303fcb72a71083cc2d59b19d0cdb2c17aa
Fixed
449be18fe31360d54a9604cc2d19a09ac8f3e20c

Affected versions

2024.*

2024.04.1
2024.04.2
2024.04.3
2024.04.4