CVE-2024-37296: 
PHP vulnerability analysis and mitigation

The Aimeos HTML client (CVE-2024-37296) is a vulnerability affecting e-commerce projects that use Aimeos HTML components. The vulnerability was discovered and disclosed on June 11, 2024, affecting versions starting from 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5. The issue allows digital downloads to be accessed without valid payment verification (GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue is classified under CWE-862 (Missing Authorization) and CWE-841 (Improper Enforcement of Behavioral Workflow). The vulnerability stems from improper payment status verification in the download functionality of the e-commerce platform (GitHub Advisory).

The vulnerability allows unauthorized users to download digital products from online shops without completing valid payment transactions. This could result in financial losses for e-commerce businesses as users can bypass payment requirements for digital goods (GitHub Advisory).

The vulnerability has been fixed in multiple versions: 2020.10.27, 2021.10.21, 2022.10.12, 2023.10.14, and 2024.04.5. Users are advised to upgrade to these patched versions to prevent unauthorized access to digital downloads (GitHub Advisory).