GHSA-v4g2-cm5v-cxv7: Digital products download without proper payment status check

1. GitHub Advisory Database
2. GitHub Reviewed
3. GHSA-v4g2-cm5v-cxv7

Digital products download without proper payment status check

Moderate severity GitHub Reviewed Published Jun 4, 2024 in aimeos/ai-client-html • Updated Jun 5, 2024

Package

composer aimeos/ai-client-html (Composer)

Affected versions

>= 2024.04.1, < 2024.04.4

>= 2023.04.1, < 2023.10.14

>= 2022.04.1, < 2022.10.12

>= 2021.04.1, < 2021.10.21

>= 2020.04.1, < 2020.10.27

Patched versions

2024.04.5

2023.10.14

2022.10.12

2021.10.21

2020.10.27

Impact

Digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn’t succeed.

Patches

New versions for the Aimeos HTML client 2020-2024 are available

References

• GHSA-v4g2-cm5v-cxv7

Published to the GitHub Advisory Database

Jun 5, 2024