p PatchFirst

CVE-2024-37295

CVE-2024-37295 · Aimeos Core remote code execution in web server context

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Aimeos is an Open Source e-commerce framework for online shops. Starting in version 2024.01.1 and prior to version 2024.04.5, a user with administrative privileges can upload files that look like images but contain PHP code which can then be executed in the context of the web server. Version 2024.04.5 fixes the issue.

CVSS 7.2 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • aimeos-core

    Versions
    • >= 2024.04.1, < 2024.04.5: Affected

    No fix published

  • aimeos/aimeos-core Packagist

    Versions
    • 2024.04.1
    • 2024.04.2
    • 2024.04.3
    • 2024.04.4
    Affected ranges
    • ECOSYSTEM: ≥ 2024.04.1, < 2024.04.5

    Update to 2024.04.5

Original sources

Check your server →