Vulnerability · Published Nov 9, 2020 · Assigned by adobe
CVE-2020-24403Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
Low 2.7
In plain English
A low-severity security flaw in Magento Commerce from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)1.6%top 23.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | magento/community-edition | 2.3.6 | GHSA-39rw-4m66-82gf |
| Packagist | magento/community-edition | 2.4.1 | GHSA-39rw-4m66-82gf |
| Packagist | magento/project-community-edition | no fix listed | GHSA-39rw-4m66-82gf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Magento Commerce | unspecified – through 2.4.0unspecified – through 2.3.5p1unspecified – through None |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
References
- https://helpx.adobe.com/security/products/magento/apsb20-59.html x_refsource_MISC