GitHub Advisoryadvisory · Packagist

GHSA-rwf7-652f-76mv Magento 2 Community Edition vulnerable to Improper Authorization

LOW Published 2022-05-24 Modified 2023-07-20 Official page ↗
Aliases
CVE-2020-24404
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-285
Reviewed
2023-07-20

Affected packages

• Packagist magento/community-edition: < 2.3.6 → fixed in 2.3.6 • Packagist magento/community-edition: >= 2.4.0, < 2.4.1 → fixed in 2.4.1

Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.

Related

Alias · CVE (1)

  • CVE-2020-24404 Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References