CVE-2020-24401 - Incorrect permissions following the deletion of a user role or deactivation of a user

Back Back to CVE browser

MEDIUM

Incorrect permissions following the deletion of a user role or deactivation of a user

Published Nov 9, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 2.32%

Description

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.

Affected products

Vendor Adobe Product Magento Commerce Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=2.3.5p1
- Version
  unspecified
  Status
  affected
  Constraints
  <=2.4.0
- Version
  unspecified
  Status
  affected
  Constraints
  <=None

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Adobe

Magento Commerce

n/a

Version	Status	Constraints
unspecified	affected	<=2.3.5p1
unspecified	affected	<=2.4.0
unspecified	affected	<=None

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-863

Incorrect Authorization

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3669
Advisory
https://github.com/advisories/GHSA-f2g3-3c6q-4478
Advisory
https://helpx.adobe.com/security/products/magento/apsb20-59.html
x_refsource_MISCVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-24401

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3669		Advisory
https://github.com/advisories/GHSA-f2g3-3c6q-4478		Advisory
https://helpx.adobe.com/security/products/magento/apsb20-59.html		x_refsource_MISCVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-24401