CVE-2024-39325: Aimeos Frontend Controller

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.

Affected products

• Aimeos Aimeos Frontend Controller: before 2020.10.15 (fixed in 2020.10.15); from 2021.04.1, before 2021.10.8 (fixed in 2021.10.8); from 2022.04.1, before 2022.10.8 (fixed in 2022.10.8); from 2023.04.1, before 2023.10.9 (fixed in 2023.10.9); version 2024.04.1 only

Published 2024-07-02. Last modified 2026-06-17.