CVE-2024-37295

HIGH

aimeos-core 2024.01.1-2024.04.4 - Authenticated Arbitrary File Upload and Remote Code Execution

Title source: llm
STIX 2.1

Description

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.

References (1)

Core 1
Core References

Scores

CVSS v3 7.2
EPSS 0.0061
EPSS Percentile 44.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-73
Status published
Products (2)
aimeos/aimeos-core 2024.04.1 - 2024.04.5Packagist
aimeos/aimeos-core >= 2024.04.1, < 2024.04.5
Published Jun 11, 2024
Tracked Since Feb 18, 2026