CVE-2020-24403 - Incorrect permissions could lead to unauthorized modification of inventory source data via REST API

Back Back to CVE browser

LOW

Incorrect permissions could lead to unauthorized modification of inventory source data via REST API

Published Nov 9, 2020

2.7

LOW

CVSS 3.1

EPSS 1.63%

Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.

Affected products

Vendor Adobe Product Magento Commerce Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=2.3.5p1
- Version
  unspecified
  Status
  affected
  Constraints
  <=2.4.0
- Version
  unspecified
  Status
  affected
  Constraints
  <=None

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Adobe

Magento Commerce

n/a

Version	Status	Constraints
unspecified	affected	<=2.3.5p1
unspecified	affected	<=2.4.0
unspecified	affected	<=None

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-285

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2152
Advisory
https://github.com/advisories/GHSA-39rw-4m66-82gf
Advisory
https://helpx.adobe.com/security/products/magento/apsb20-59.html
x_refsource_MISCVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-24403

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2152		Advisory
https://github.com/advisories/GHSA-39rw-4m66-82gf		Advisory
https://helpx.adobe.com/security/products/magento/apsb20-59.html		x_refsource_MISCVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-24403