Overview
- Description
- aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue.
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 3.8
- Impact score
- 2.5
- Exploitability score
- 1.2
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
- Severity
- LOW
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:aimeos:ai-admin-graphql:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CCCBEC57-5E51-404A-A93E-F04C20753EE8",
"versionEndExcluding": "2022.10.10",
"versionStartIncluding": "2022.04.1"
},
{
"criteria": "cpe:2.3:a:aimeos:ai-admin-graphql:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "342DA783-3693-4F4A-9338-A419FB2BD435",
"versionEndExcluding": "2023.10.6",
"versionStartIncluding": "2023.04.1"
},
{
"criteria": "cpe:2.3:a:aimeos:ai-admin-graphql:2024.04.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1942C6DA-0B87-45DD-BDEE-1C68C33BCC1A"
}
],
"operator": "OR"
}
]
}
]