Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2024-47173: Aimeos admin GraphQL API can be crashed
CVE-2024-47173 · published 2 years ago
Summary
If you run Aimeos’s admin GraphQL interface in a SaaS or marketplace setup, a crafted request could cause the service to stop responding. This affects versions released between April 2024 and July 2024. Upgrade to version 2024.07.2 or later to stop the problem.
What to do
- Update aimeos ai-admin-graphql to version 2024.07.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | aimeos | ai-admin-graphql |
>= 2024.04.1, < 2024.07.2 Fix: upgrade to 2024.07.2
|
Original advisory text
Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups
Aimeos is an e-commerce framework. All SaaS and marketplace setups using the Aimeos GraphQL API admin interface version from 2024.04 up to 2024.07.1 are affected by a potential denial of service attack. Version 2024.07.2 fixes the issue.
References
- https://github.com/advisories/GHSA-qxgx-hvg3-v92w
- https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-qxgx-hvg3-v9... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-47173 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47173... Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-270Privilege Context Switching Error
Timeline
Published24 Oct 2024
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta