CVE-2024-39322
aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records
aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records
aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.
- Record
CVE-2024-39322- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2024-2296
aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.
- Record
EUVD-2024-2296- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8fj2-587w-5whr
aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records
Improper access control allows editors to remove admin group and locale configuration in Aimeos backend
- Record
GHSA-8fj2-587w-5whr- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.
- Record
CVE-2024-39322- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records
aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API for administrative tasks. In versions prior to 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2, improper access control allows editors to remove admin group and locale configuration in the Aimeos backend. Versions 2020.10.13, 2021.10.6, 2022.10.3, 2023.10.4, and 2024.4.2 contain a fix for the issue.
- Record
CVE-2024-39322- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-8fj2-587w-5whr
aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records
Improper access control allows editors to remove admin group and locale configuration in Aimeos backend
- Record
GHSA-8fj2-587w-5whr- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aimeos/ai-admin-jsonadmPackagist |
2024.04.1 to 2024.04.1 | 2024.04.2 |
aimeos/ai-admin-jsonadmPackagist |
2023.04.1 up to 2023.10.4 | 2023.10.4 |
aimeos/ai-admin-jsonadmPackagist |
2022.04.1 up to 2022.10.3 | 2022.10.3 |
aimeos/ai-admin-jsonadmPackagist |
2021.04.1 up to 2021.10.6 | 2021.10.6 |
aimeos/ai-admin-jsonadmPackagist |
before 2020.10.13 | 2020.10.13 |
aimeos/ai-admin-jsonadmPackagist |
2024.04.1 up to 2024.04.2 | 2024.04.2 |
aimeos/ai-admin-jsonadmPackagist |
2023.04.1 up to 2023.10.4, plus listed versions 2023.07.12023.10.12023.10.22023.10.3 |
2023.10.4 |
aimeos/ai-admin-jsonadmPackagist |
2022.04.1 up to 2022.10.3, plus listed versions 2022.04.22022.07.12022.10.12022.10.2 |
2022.10.3 |
aimeos/ai-admin-jsonadmPackagist |
2021.04.1 up to 2021.10.6, plus listed versions 2021.04.22021.04.32021.07.12021.07.22021.07.3 Show 5 moreShow less2021.10.12021.10.22021.10.32021.10.42021.10.5 |
2021.10.6 |
aimeos/ai-admin-jsonadmPackagist |
before 2020.10.13, plus listed versions 2016.07.12016.07.22016.10.12017.01.12017.01.2 Show 45 moreShow less2017.04.12017.04.22017.04.32017.04.42017.07.12017.07.22017.07.32017.10.12017.10.22017.10.32017.10.42017.10.52018.01.12018.01.22018.04.12018.04.22018.04.32018.07.12018.07.22018.07.32018.10.12018.10.22018.10.32018.10.42018.10.52019.01.12019.04.12019.04.22019.04.32019.07.12019.07.22019.07.32019.10.12019.10.22019.10.32019.10.42019.10.52019.10.62019.10.72019.10.82020.01.12020.04.12020.04.22020.07.12020.07.2 |
2020.10.13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-39322 is a medium vulnerability (CVSS 5.5) in Aimeos Ai-admin-jsonadm, published July 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in aimeos/ai-admin-jsonadm 2024.04.2.
References
github.com/aimeos/ai-admin-jsonadm/security/advisories/GHSA-8fj2-587w-5whr
Left out here: 12 versions. The JSON record has them.