{"id":"GHSA-v4g2-cm5v-cxv7","summary":"Digital products download without proper payment status check","details":"### Impact\nDigital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed.\n\n### Patches\nNew versions for the Aimeos HTML client 2020-2024 are available\n","aliases":["CVE-2024-37296"],"modified":"2024-06-11T21:14:02.390254Z","published":"2024-06-05T13:30:55Z","related":["CVE-2024-37296"],"database_specific":{"cwe_ids":["CWE-841"],"github_reviewed_at":"2024-06-05T13:30:55Z","github_reviewed":true,"nvd_published_at":"2024-06-11T15:16:09Z","severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37296"},{"type":"WEB","url":"https://github.com/aimeos/ai-client-html/commit/12d8aad1a373bf9d350872501adec3e222164f83"},{"type":"WEB","url":"https://github.com/aimeos/ai-client-html/commit/5a7249769142b3ce70959ab1fb70c7e7c251e214"},{"type":"WEB","url":"https://github.com/aimeos/ai-client-html/commit/6460ffe8f4929d864164aa96c5b49eca5326d975"},{"type":"WEB","url":"https://github.com/aimeos/ai-client-html/commit/7f01d2f4fbc67f5231fd84adeb835d28252b8409"},{"type":"WEB","url":"https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99346b561cea515c5f0"},{"type":"PACKAGE","url":"https://github.com/aimeos/ai-client-html"}],"affected":[{"package":{"name":"aimeos/ai-client-html","ecosystem":"Packagist","purl":"pkg:composer/aimeos/ai-client-html"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2024.04.1"},{"fixed":"2024.04.5"}]}],"versions":["2024.04.1","2024.04.2","2024.04.3","2024.04.4"],"database_specific":{"last_known_affected_version_range":"\u003c 2024.04.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-v4g2-cm5v-cxv7/GHSA-v4g2-cm5v-cxv7.json"}},{"package":{"name":"aimeos/ai-client-html","ecosystem":"Packagist","purl":"pkg:composer/aimeos/ai-client-html"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2023.04.1"},{"fixed":"2023.10.14"}]}],"versions":["2023.04.1","2023.04.2","2023.04.3","2023.04.4","2023.07.1","2023.07.2","2023.07.3","2023.07.4","2023.07.5","2023.07.6","2023.10.1","2023.10.10","2023.10.11","2023.10.12","2023.10.13","2023.10.2","2023.10.3","2023.10.4","2023.10.5","2023.10.6","2023.10.7","2023.10.8","2023.10.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-v4g2-cm5v-cxv7/GHSA-v4g2-cm5v-cxv7.json"}},{"package":{"name":"aimeos/ai-client-html","ecosystem":"Packagist","purl":"pkg:composer/aimeos/ai-client-html"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2022.04.1"},{"fixed":"2022.10.12"}]}],"versions":["2022.04.1","2022.04.10","2022.04.11","2022.04.12","2022.04.13","2022.04.14","2022.04.15","2022.04.2","2022.04.3","2022.04.4","2022.04.5","2022.04.6","2022.04.7","2022.04.8","2022.04.9","2022.07.1","2022.07.2","2022.07.3","2022.07.4","2022.10.1","2022.10.10","2022.10.11","2022.10.2","2022.10.3","2022.10.4","2022.10.5","2022.10.6","2022.10.7","2022.10.8","2022.10.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-v4g2-cm5v-cxv7/GHSA-v4g2-cm5v-cxv7.json"}},{"package":{"name":"aimeos/ai-client-html","ecosystem":"Packagist","purl":"pkg:composer/aimeos/ai-client-html"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2021.04.1"},{"fixed":"2021.10.21"}]}],"versions":["2021.04.1","2021.04.10","2021.04.11","2021.04.12","2021.04.13","2021.04.14","2021.04.2","2021.04.3","2021.04.4","2021.04.5","2021.04.6","2021.04.7","2021.04.8","2021.04.9","2021.07.1","2021.07.10","2021.07.11","2021.07.12","2021.07.13","2021.07.2","2021.07.3","2021.07.4","2021.07.5","2021.07.6","2021.07.7","2021.07.8","2021.07.9","2021.10.1","2021.10.10","2021.10.11","2021.10.12","2021.10.13","2021.10.14","2021.10.15","2021.10.16","2021.10.17","2021.10.18","2021.10.19","2021.10.2","2021.10.20","2021.10.3","2021.10.4","2021.10.5","2021.10.6","2021.10.7","2021.10.8","2021.10.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-v4g2-cm5v-cxv7/GHSA-v4g2-cm5v-cxv7.json"}},{"package":{"name":"aimeos/ai-client-html","ecosystem":"Packagist","purl":"pkg:composer/aimeos/ai-client-html"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2020.04.1"},{"fixed":"2020.10.27"}]}],"versions":["2020.04.1","2020.04.2","2020.04.3","2020.04.4","2020.04.5","2020.04.6","2020.04.7","2020.07.1","2020.07.2","2020.07.3","2020.07.4","2020.07.5","2020.07.6","2020.10.1","2020.10.10","2020.10.11","2020.10.12","2020.10.13","2020.10.14","2020.10.15","2020.10.16","2020.10.17","2020.10.18","2020.10.19","2020.10.2","2020.10.20","2020.10.21","2020.10.22","2020.10.23","2020.10.24","2020.10.25","2020.10.26","2020.10.3","2020.10.4","2020.10.5","2020.10.6","2020.10.7","2020.10.8","2020.10.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-v4g2-cm5v-cxv7/GHSA-v4g2-cm5v-cxv7.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}]}