Digital products download without proper payment status check

Moderate

aimeos published GHSA-v4g2-cm5v-cxv7

Jun 4, 2024

Package

aimeos/ai-client-html (Composer)

Affected versions

>= 2024.04.1, < 2024.04.4

>= 2023.04.1, < 2023.10.14

>= 2022.04.1, < 2022.10.12

>= 2021.04.1, < 2021.10.21

>= 2020.04.1, < 2020.10.27

Patched versions

2024.04.5

2023.10.14

2022.10.12

2021.10.21

2020.10.27

Description

Impact

Digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed.

Patches

New versions for the Aimeos HTML client 2020-2024 are available

Severity

Moderate

5.3

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N