MEDIUM5.3
GHSA-v4g2-cm5v-cxv7
Digital products download without proper payment status check
Quick fix
GHSA-v4g2-cm5v-cxv7 — aimeos/ai-client-html: upgrade to the fixed version with the command below.
composer require aimeos/ai-client-html:^2024.04.5Details
### Impact Digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed.
### Patches New versions for the Aimeos HTML client 2020-2024 are available
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/aimeos/ai-client-html
Introduced in:
2024.04.1Fixed in: 2024.04.5Fix
composer require aimeos/ai-client-html:^2024.04.5Packagist/aimeos/ai-client-html
Introduced in:
2023.04.1Fixed in: 2023.10.14Fix
composer require aimeos/ai-client-html:^2023.10.14Packagist/aimeos/ai-client-html
Introduced in:
2022.04.1Fixed in: 2022.10.12Fix
composer require aimeos/ai-client-html:^2022.10.12Packagist/aimeos/ai-client-html
Introduced in:
2021.04.1Fixed in: 2021.10.21Fix
composer require aimeos/ai-client-html:^2021.10.21Packagist/aimeos/ai-client-html
Introduced in:
2020.04.1Fixed in: 2020.10.27Fix
composer require aimeos/ai-client-html:^2020.10.27References
- https://github.com/aimeos/ai-client-html/security/advisories/GHSA-v4g2-cm5v-cxv7[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2024-37296[ADVISORY]
- https://github.com/aimeos/ai-client-html/commit/12d8aad1a373bf9d350872501adec3e222164f83[WEB]
- https://github.com/aimeos/ai-client-html/commit/5a7249769142b3ce70959ab1fb70c7e7c251e214[WEB]
- https://github.com/aimeos/ai-client-html/commit/6460ffe8f4929d864164aa96c5b49eca5326d975[WEB]
- https://github.com/aimeos/ai-client-html/commit/7f01d2f4fbc67f5231fd84adeb835d28252b8409[WEB]
- https://github.com/aimeos/ai-client-html/commit/fc611ff9a57e421d0ad9d99346b561cea515c5f0[WEB]
- https://github.com/aimeos/ai-client-html[PACKAGE]