CVE-2024-37294
Aimeos denial of service vulnerability in SaaS and marketplace setups
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Aimeos denial of service vulnerability in SaaS and marketplace setups
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
- Record
CVE-2024-37294- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-270
- Updated
- 2026-11-02
EUVDEUVD-2024-1864
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
- Record
EUVD-2024-1864- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xjm6-jfmg-qc6p
Aimeos denial of service vulnerability in SaaS and marketplace setups
Impact
All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack
Patches
Upgrade to the latest 2022.10 LTS, 2023.10 LTS and 2024.04.7 version of the aimeos/aimeos-core package
- Record
GHSA-xjm6-jfmg-qc6p- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-270
- Updated
- 2026-11-02
NVD
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
- Record
CVE-2024-37294- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-270
- Updated
- 2026-11-02
OSV
Aimeos denial of service vulnerability in SaaS and marketplace setups
Aimeos is an Open Source e-commerce framework for online shops. All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack. Users should upgrade to versions 2022.10.17, 2023.10.17, or 2024.04 of the aimeos/aimeos-core package to receive a patch.
- Record
CVE-2024-37294- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-270
- Updated
- 2026-11-02
OSVGHSA-xjm6-jfmg-qc6p
Aimeos denial of service vulnerability in SaaS and marketplace setups
Impact
All SaaS and marketplace setups using Aimeos version from 2022/2023/2024 are affected by a potential denial of service attack
Patches
Upgrade to the latest 2022.10 LTS, 2023.10 LTS and 2024.04.7 version of the aimeos/aimeos-core package
- Record
GHSA-xjm6-jfmg-qc6p- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-270
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aimeos/aimeos-corePackagist |
2024.04.1 up to 2024.04.7 | 2024.04.7 |
aimeos/aimeos-corePackagist |
2023.04.1 up to 2023.10.17 | 2023.10.17 |
aimeos/aimeos-corePackagist |
2022.04.1 up to 2022.10.17 | 2022.10.17 |
aimeos/aimeos-corePackagist |
2024.04.1 up to 2024.04.7, plus listed versions 2024.04.22024.04.32024.04.42024.04.52024.04.6 |
2024.04.7 |
aimeos/aimeos-corePackagist |
2023.04.1 up to 2023.10.17, plus listed versions 2023.04.22023.04.32023.04.42023.04.52023.04.6 Show 19 moreShow less2023.07.12023.07.22023.07.32023.10.12023.10.102023.10.112023.10.122023.10.132023.10.142023.10.152023.10.162023.10.22023.10.32023.10.42023.10.52023.10.62023.10.72023.10.82023.10.9 |
2023.10.17 |
aimeos/aimeos-corePackagist |
2022.04.1 up to 2022.10.17, plus listed versions 2022.04.102022.04.22022.04.32022.04.42022.04.5 Show 28 moreShow less2022.04.62022.04.72022.04.82022.04.92022.07.12022.07.22022.07.32022.07.42022.07.52022.07.62022.07.72022.07.82022.10.12022.10.102022.10.112022.10.122022.10.132022.10.142022.10.152022.10.162022.10.22022.10.32022.10.42022.10.52022.10.62022.10.72022.10.82022.10.9 |
2022.10.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-37294 is a medium vulnerability (CVSS 5.5) in Aimeos Aimeos-core, published May 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in aimeos/aimeos-core 2024.04.7.
References
github.com/aimeos/aimeos-core/security/advisories/GHSA-xjm6-jfmg-qc6p