-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| aimeos/ai-client-html | composer | >= 2024.04.1, < 2024.04.4 | 2024.04.5 |
| aimeos/ai-client-html | composer | >= 2023.04.1, < 2023.10.14 | 2023.10.14 |
| aimeos/ai-client-html | composer | >= 2022.04.1, < 2022.10.12 | 2022.10.12 |
| aimeos/ai-client-html | composer | >= 2021.04.1, < 2021.10.21 | 2021.10.21 |
| aimeos/ai-client-html | composer | >= 2020.04.1, < 2020.10.27 | 2020.10.27 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing payment status validation in the download authorization workflow. The patch adds a payment status check to the search filter in checkAccess(). The affected versions lacked this critical payment verification step, making the checkAccess method the vulnerable entry point. The function's purpose (access control for downloads) and the patch's focus on this method confirm its role in the vulnerability.