CVE-2024-37296
Aimeos HTML client vulnerable to digital products download without proper payment status check
The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Aimeos HTML client vulnerable to digital products download without proper payment status check
The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.
- Record
CVE-2024-37296- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-841, CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2024-2168
The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.
- Record
EUVD-2024-2168- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v4g2-cm5v-cxv7
Digital products download without proper payment status check
Impact
Digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed.
Patches
New versions for the Aimeos HTML client 2020-2024 are available
- Record
GHSA-v4g2-cm5v-cxv7- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-841
- Updated
- 2026-11-02
NVD
The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.
- Record
CVE-2024-37296- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-841, CWE-862
- Updated
- 2026-11-02
OSV
Aimeos HTML client vulnerable to digital products download without proper payment status check
The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5, digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. Versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5 fix this issue.
- Record
CVE-2024-37296- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-841, CWE-862
- Updated
- 2026-11-02
OSVGHSA-v4g2-cm5v-cxv7
Digital products download without proper payment status check
Impact
Digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed.
Patches
New versions for the Aimeos HTML client 2020-2024 are available
- Record
GHSA-v4g2-cm5v-cxv7- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-841
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aimeos/ai-client-htmlPackagist |
2024.04.1 up to 2024.04.4 | 2024.04.4 |
aimeos/ai-client-htmlPackagist |
2023.04.1 up to 2023.10.14 | 2023.10.14 |
aimeos/ai-client-htmlPackagist |
2022.04.1 up to 2022.10.12 | 2022.10.12 |
aimeos/ai-client-htmlPackagist |
2021.04.1 up to 2021.10.21 | 2021.10.21 |
aimeos/ai-client-htmlPackagist |
2020.04.1 up to 2020.10.27 | 2020.10.27 |
aimeos/ai-client-htmlPackagist |
2024.04.1 up to 2024.04.5, plus listed versions 2024.04.22024.04.32024.04.4 |
2024.04.5 |
aimeos/ai-client-htmlPackagist |
2023.04.1 up to 2023.10.14, plus listed versions 2023.04.22023.04.32023.04.42023.07.12023.07.2 Show 17 moreShow less2023.07.32023.07.42023.07.52023.07.62023.10.12023.10.102023.10.112023.10.122023.10.132023.10.22023.10.32023.10.42023.10.52023.10.62023.10.72023.10.82023.10.9 |
2023.10.14 |
aimeos/ai-client-htmlPackagist |
2022.04.1 up to 2022.10.12, plus listed versions 2022.04.102022.04.112022.04.122022.04.132022.04.14 Show 24 moreShow less2022.04.152022.04.22022.04.32022.04.42022.04.52022.04.62022.04.72022.04.82022.04.92022.07.12022.07.22022.07.32022.07.42022.10.12022.10.102022.10.112022.10.22022.10.32022.10.42022.10.52022.10.62022.10.72022.10.82022.10.9 |
2022.10.12 |
aimeos/ai-client-htmlPackagist |
2021.04.1 up to 2021.10.21, plus listed versions 2021.04.102021.04.112021.04.122021.04.132021.04.14 Show 41 moreShow less2021.04.22021.04.32021.04.42021.04.52021.04.62021.04.72021.04.82021.04.92021.07.12021.07.102021.07.112021.07.122021.07.132021.07.22021.07.32021.07.42021.07.52021.07.62021.07.72021.07.82021.07.92021.10.12021.10.102021.10.112021.10.122021.10.132021.10.142021.10.152021.10.162021.10.172021.10.182021.10.192021.10.22021.10.202021.10.32021.10.42021.10.52021.10.62021.10.72021.10.82021.10.9 |
2021.10.21 |
aimeos/ai-client-htmlPackagist |
2020.04.1 up to 2020.10.27, plus listed versions 2020.04.22020.04.32020.04.42020.04.52020.04.6 Show 33 moreShow less2020.04.72020.07.12020.07.22020.07.32020.07.42020.07.52020.07.62020.10.12020.10.102020.10.112020.10.122020.10.132020.10.142020.10.152020.10.162020.10.172020.10.182020.10.192020.10.22020.10.202020.10.212020.10.222020.10.232020.10.242020.10.252020.10.262020.10.32020.10.42020.10.52020.10.62020.10.72020.10.82020.10.9 |
2020.10.27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-37296 is a medium vulnerability (CVSS 5.3) in Aimeos Ai-client-html, published June 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in aimeos/ai-client-html 2024.04.4.
References
github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7