CVE-2024-39319
aimeos/ai-controller-frontend has IDOR vulnerability in account profile page
aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
aimeos/ai-controller-frontend has IDOR vulnerability in account profile page
aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Record
CVE-2024-39319- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
EUVDEUVD-2024-2868
aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Record
EUVD-2024-2868- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rw3j-574h-mrcq
IDOR vulnerability in account profile page
Impact
Insecure direct object reference allowing an attacker to disable subscriptions and reviews of another customer
- Record
GHSA-rw3j-574h-mrcq- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
NVD
aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Record
CVE-2024-39319- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
OSV
aimeos/ai-controller-frontend has IDOR vulnerability in account profile page
aimeos/ai-controller-frontend is the Aimeos frontend controller package for e-commerce projects. Prior to versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, an insecure direct object reference allows an attacker to disable subscriptions and reviews of another customer. Versions 2024.4.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Record
CVE-2024-39319- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
OSVGHSA-rw3j-574h-mrcq
IDOR vulnerability in account profile page
Impact
Insecure direct object reference allowing an attacker to disable subscriptions and reviews of another customer
- Record
GHSA-rw3j-574h-mrcq- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-639
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aimeos/ai-controller-frontendPackagist |
2024.04.1 to 2024.04.1 | 2024.04.2 |
aimeos/ai-controller-frontendPackagist |
2023.04.1 up to 2023.10.9 | 2023.10.9 |
aimeos/ai-controller-frontendPackagist |
2022.04.1 up to 2022.10.8 | 2022.10.8 |
aimeos/ai-controller-frontendPackagist |
2021.04.1 up to 2021.10.8 | 2021.10.8 |
aimeos/ai-controller-frontendPackagist |
before 2020.10.15 | 2020.10.15 |
aimeos/ai-controller-frontendPackagist |
2024.04.1 up to 2024.04.2 | 2024.04.2 |
aimeos/ai-controller-frontendPackagist |
2023.04.1 up to 2023.10.9, plus listed versions 2023.04.22023.07.12023.10.12023.10.22023.10.3 Show 5 moreShow less2023.10.42023.10.52023.10.62023.10.72023.10.8 |
2023.10.9 |
aimeos/ai-controller-frontendPackagist |
2022.04.1 up to 2022.10.8, plus listed versions 2022.04.22022.04.32022.04.42022.04.52022.07.1 Show 9 moreShow less2022.07.22022.07.32022.10.12022.10.22022.10.32022.10.42022.10.52022.10.62022.10.7 |
2022.10.8 |
aimeos/ai-controller-frontendPackagist |
2021.04.1 up to 2021.10.8, plus listed versions 2021.04.22021.04.32021.04.42021.04.52021.07.1 Show 8 moreShow less2021.07.22021.10.12021.10.22021.10.32021.10.42021.10.52021.10.62021.10.7 |
2021.10.8 |
aimeos/ai-controller-frontendPackagist |
before 2020.10.15, plus listed versions 2016.07.12016.07.22016.07.32016.10.12016.10.2 Show 45 moreShow less2016.10.32016.10.42016.10.52016.10.62017.01.12017.01.22017.04.12017.04.22017.04.32017.04.42017.04.52017.04.62017.04.72017.07.12017.07.22017.07.32017.10.12017.10.22017.10.32017.10.42017.10.52018.01.12018.01.22018.04.12018.04.22018.04.32018.07.12018.07.22018.07.32018.07.42018.07.52018.07.62018.10.12018.10.22018.10.32018.10.42018.10.52018.10.62018.10.72018.10.82018.10.92019.01.12019.01.22019.04.12019.04.2 |
2020.10.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-39319 is a medium vulnerability (CVSS 5.3) in Aimeos Ai-controller-frontend, published September 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 42nd percentile. Fixed in aimeos/ai-controller-frontend 2024.04.2.
References
github.com/aimeos/ai-controller-frontend/security/advisories/GHSA-rw3j-574h-mrcq
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-39319
Left out here: 43 versions. The JSON record has them.