CVE-2024-39325
aimeos/ai-controller-frontend doesn't reset payment status in basket
aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
aimeos/ai-controller-frontend doesn't reset payment status in basket
aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Record
CVE-2024-39325- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-841
- Updated
- 2026-11-02
EUVDEUVD-2024-2380
aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Record
EUVD-2024-2380- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m9gv-6p22-qgmj
ai-controller-frontend payment status in basket isn't reset
Impact
Payment status in basket isn't reset
- Record
GHSA-m9gv-6p22-qgmj- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-841
- Updated
- 2026-11-02
NVD
aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Record
CVE-2024-39325- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-841
- Updated
- 2026-11-02
OSV
aimeos/ai-controller-frontend doesn't reset payment status in basket
aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.
- Record
CVE-2024-39325- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-841
- Updated
- 2026-11-02
OSVGHSA-m9gv-6p22-qgmj
ai-controller-frontend payment status in basket isn't reset
Impact
Payment status in basket isn't reset
- Record
GHSA-m9gv-6p22-qgmj- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-841
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
aimeos/ai-controller-frontendPackagist |
2023.04.1 up to 2023.10.9 | 2023.10.9 |
aimeos/ai-controller-frontendPackagist |
2022.04.1 up to 2022.10.8 | 2022.10.8 |
aimeos/ai-controller-frontendPackagist |
2021.04.1 up to 2021.10.8 | 2021.10.8 |
aimeos/ai-controller-frontendPackagist |
before 2020.10.15 | 2020.10.15 |
aimeos/ai-controller-frontendPackagist |
2023.04.1 up to 2023.10.9, plus listed versions 2023.04.22023.07.12023.10.12023.10.22023.10.3 Show 5 moreShow less2023.10.42023.10.52023.10.62023.10.72023.10.8 |
2023.10.9 |
aimeos/ai-controller-frontendPackagist |
2022.04.1 up to 2022.10.8, plus listed versions 2022.04.22022.04.32022.04.42022.04.52022.07.1 Show 9 moreShow less2022.07.22022.07.32022.10.12022.10.22022.10.32022.10.42022.10.52022.10.62022.10.7 |
2022.10.8 |
aimeos/ai-controller-frontendPackagist |
2021.04.1 up to 2021.10.8, plus listed versions 2021.04.22021.04.32021.04.42021.04.52021.07.1 Show 8 moreShow less2021.07.22021.10.12021.10.22021.10.32021.10.42021.10.52021.10.62021.10.7 |
2021.10.8 |
aimeos/ai-controller-frontendPackagist |
before 2020.10.15, plus listed versions 2016.07.12016.07.22016.07.32016.10.12016.10.2 Show 45 moreShow less2016.10.32016.10.42016.10.52016.10.62017.01.12017.01.22017.04.12017.04.22017.04.32017.04.42017.04.52017.04.62017.04.72017.07.12017.07.22017.07.32017.10.12017.10.22017.10.32017.10.42017.10.52018.01.12018.01.22018.04.12018.04.22018.04.32018.07.12018.07.22018.07.32018.07.42018.07.52018.07.62018.10.12018.10.22018.10.32018.10.42018.10.52018.10.62018.10.72018.10.82018.10.92019.01.12019.01.22019.04.12019.04.2 |
2020.10.15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-39325 is a medium vulnerability (CVSS 5.3) in Aimeos Ai-controller-frontend, published July 2, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in aimeos/ai-controller-frontend 2023.10.9.
References
github.com/aimeos/ai-controller-frontend/security/advisories/GHSA-m9gv-6p22-qgmj
Left out here: 43 versions. The JSON record has them.