CVE-2024-39319

aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.

• CWE-639

• https://github.com/aimeos/ai-controller-frontend/commit/2ad5c062a629af374da470a319914c321c9bfee2Patch
• https://github.com/aimeos/ai-controller-frontend/commit/53eebdc51fae34440dfd768a7811c169c7779aa9Patch
• https://github.com/aimeos/ai-controller-frontend/commit/5833db6d18a889b94dc036dfb84b6f5cca73fbacPatch
• https://github.com/aimeos/ai-controller-frontend/commit/6ea6b82f5a1fc18c574cb6f97225930d139b14a5Patch
• https://github.com/aimeos/ai-controller-frontend/commit/700da5ea2b622724b68c8684346bf74ac3bbca9bPatch
• https://github.com/aimeos/ai-controller-frontend/commit/7c93139f86eff9ec26b117a8918e06ce6cc0000fPatch
• https://github.com/aimeos/ai-controller-frontend/commit/ae7baa3f2fbf594c2c1e4b1aae83364a84b241a6Patch
• https://github.com/aimeos/ai-controller-frontend/commit/cd8c95aa4663f54bd66a69c5952f2e42405426f3Patch
• https://github.com/aimeos/ai-controller-frontend/commit/d4eac06f3a25330c089d8be4397f2ab1936dd9bbPatch
• https://github.com/aimeos/ai-controller-frontend/commit/f7c6a9ce2a6f5a9ad4af31313508870a78398f85Patch
• https://github.com/aimeos/ai-controller-frontend/security/advisories/GHSA-rw3j-574h-mrcqVendor Advisory

Published

Sep 26, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39313toy-blog is a headless content management system implementat…5.3
• CVE-2024-39314toy-blog is a headless content management system implementat…4.7
• CVE-2024-39315Pomerium is an identity and context-aware access proxy. Prio…6.5
• CVE-2024-39316Rack is a modular Ruby web server interface. Starting in ver…6.5
• CVE-2024-39317Wagtail is an open source content management system built on…4.9
• CVE-2024-39318The Ibexa Admin UI Bundle contains all the necessary parts t…5.4
• CVE-2024-3932A vulnerability classified as problematic has been found in …3.1
• CVE-2024-39320Discourse is an open source discussion platform. Prior to 3.…6.1
• CVE-2024-39321Traefik is an HTTP reverse proxy and load balancer. Versions…7.5
• CVE-2024-39322aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API fo…5.5
• CVE-2024-39323aimeos/ai-admin-graphql is the Aimeos GraphQL API admin inte…7.1
• CVE-2024-39324aimeos/ai-admin-graphql is the Aimeos GraphQL API admin inte…3.8