Digital products download without proper payment status check
Date: 2024-06
Affected: composer/aimeos/ai-client-html, composer/aimeos/ai-client-html, composer/aimeos/ai-client-html
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-37296
CWE: CWE-841
CVSS: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

### Impact Digital downloads sold in online shops can be downloaded without valid payment, e.g. if the payment didn't succeed. ### Patches New versions for the Aimeos HTML client 2020-2024 are available


Mitigations:

Architectural layers (MAESTRO):