CVE-2024-47173: 
PHP vulnerability analysis and mitigation

Aimeos, an e-commerce framework, has been identified with a vulnerability affecting its GraphQL API admin interface in versions from 2024.04 up to 2024.07.1. The vulnerability was discovered and disclosed on October 24, 2024, specifically impacting SaaS and marketplace setups using the Aimeos GraphQL API admin interface (GitHub Advisory).

The vulnerability has been assigned CVE-2024-47173 and received a CVSS v3.1 base score of 5.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H. The weakness is categorized as CWE-270 (Privilege Context Switching Error). The vulnerability requires high privileges but no user interaction, with network attack vector and low attack complexity (GitHub Advisory).

The vulnerability could potentially lead to a denial of service attack in SaaS and marketplace setups. The CVSS metrics indicate high impact on availability and low impact on integrity, while confidentiality remains unaffected (GitHub Advisory).

The vulnerability requires network access and high privileges to exploit, though with low attack complexity. No user interaction is needed for exploitation. The attack vector is network-based, indicating remote exploitation possibility (GitHub Advisory).

The vulnerability has been patched in version 2024.07.2. Users are advised to upgrade to this version to mitigate the security risk (GitHub Advisory).