GitHub Advisoryadvisory · Packagist

GHSA-hvf5-4jr9-fghh Magento incorrect permissions vulnerability in the Integrations component

MEDIUM Published 2022-05-24 Modified 2025-02-10 Official page ↗
Aliases
CVE-2020-24402
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-276, CWE-285
Reviewed
2024-01-11

Affected packages

• Packagist magento/community-edition: < 2.3.6 → fixed in 2.3.6 • Packagist magento/community-edition: >= 2.4.0, < 2.4.1 → fixed in 2.4.1 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization.

Related

Alias · CVE (1)

  • CVE-2020-24402 Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. vulnerability

Weakness · CWE (2)

  • CWE-276 Incorrect Default Permissions weakness
  • CWE-285 Improper Authorization weakness

References