GitHub Advisoryadvisory · Packagist

GHSA-39rw-4m66-82gf Magento incorrect user permissions vulnerability within the Inventory component

LOW Published 2022-05-24 Modified 2025-02-10 Official page ↗
Aliases
CVE-2020-24403
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-285
Reviewed
2024-01-11

Affected packages

• Packagist magento/community-edition: < 2.3.6 → fixed in 2.3.6 • Packagist magento/community-edition: >= 2.4.0, < 2.4.1 → fixed in 2.4.1 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.

Related

Alias · CVE (1)

  • CVE-2020-24403 Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References