aimeos/ai-admin-graphql 不当访问控制漏洞允许编辑者修改管理员账户 (CVE-2024-39323)

CVE编号

CVE-2024-39323

利用情况

暂无

补丁情况

N/A

披露时间

2024-07-03

漏洞描述

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability allows an editor to modify and take over an admin account in the back end. Versions 2022.10.10, 2023.10.6, and 2024.04.6 fix this issue.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/aimeos/ai-admin-graphql/commit/2d89d98cdcad880a9244b50736b...
https://github.com/aimeos/ai-admin-graphql/commit/54d6b7cf4530cb3b95f52775c24...
https://github.com/aimeos/ai-admin-graphql/commit/787028de0a3ecbf3e9f63ab1454...
https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-vc7j-99jw-jrqm

CVSS3评分 N/A

• 攻击路径 N/A
• 攻击复杂度 N/A
• 权限要求 N/A
• 影响范围 N/A
• 用户交互 N/A
• 可用性 N/A
• 保密性 N/A
• 完整性 N/A

N/A

CWE-ID	漏洞类型

Exp相关链接

- avd.aliyun.com