NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

ai-controller-frontend payment status in basket isn't resetGHSA-m9gv-6p22-qgmj

MEDIUMFix: aimeos/ai-controller-frontend@16b8837

GHSA-m9gv-6p22-qgmj is a medium-severity (CVSS 5.3) CWE-841 vulnerability in aimeos/ai-controller-frontend. A fix is available for aimeos/ai-controller-frontend — see the affected versions and patch details below.

Also known asCVE-2024-39325
Published
Updated
Affected
4 pkgs
Patched
4 / 4
Exploits
None indexed
Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for GHSA-m9gv-6p22-qgmj.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs37th percentile — riskier than 37% of all scored CVEsHighest risk
0.00%0.39%0.78%1.17%0.7%0.4%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

4 pkgs affected
🐘aimeos/ai-controller-frontend🐘aimeos/ai-controller-frontend🐘aimeos/ai-controller-frontend🐘aimeos/ai-controller-frontend

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-controller-frontend doesn't reset the payment status of a user's basket after the user completes a purchase. Versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15 fix this issue.

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistaimeos/ai-controller-frontend≥ 2023.04.1&&< 2023.10.92023.10.9composer require aimeos/ai-controller-frontend:^2023.10.9
🐘Packagistaimeos/ai-controller-frontend≥ 2022.04.1&&< 2022.10.82022.10.8composer require aimeos/ai-controller-frontend:^2022.10.8
🐘Packagistaimeos/ai-controller-frontend≥ 2021.04.1&&< 2021.10.82021.10.8composer require aimeos/ai-controller-frontend:^2021.10.8
🐘Packagistaimeos/ai-controller-frontendall versions2020.10.15composer require aimeos/ai-controller-frontend:^2020.10.15

Affected Products

1 product · 5 configurations
Application
aimeos frontend controlleraimeos
≥ 2023.04.1 && < 2023.10.9
1 version
2024.04.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for aimeos/ai-controller-frontend, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update aimeos/ai-controller-frontend to 2023.10.9 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-m9gv-6p22-qgmj is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact Payment status in basket isn't reset
O3 Security · Impact-Aware SCA

Is GHSA-m9gv-6p22-qgmj in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
GHSA-m9gv-6p22-qgmj: ai-controller — Fixed in 2023.10.9