CVE-2020-24401: Magento 2 Community Edition Incorrect Authorization
Magento 2 Community Edition Incorrect Authorization
Other sources
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.1
Event History
Frequently Asked Questions
What is the vulnerability ID of this Magento vulnerability?
The vulnerability ID of this Magento vulnerability is CVE-2020-24401.
What is the title of this Magento vulnerability?
The title of this Magento vulnerability is 'Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability.'
What is the severity of CVE-2020-24401?
The severity of CVE-2020-24401 is medium, with a severity value of 6.5.
Which Magento versions are affected by CVE-2020-24401?
Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by CVE-2020-24401.
How can I fix the incorrect authorization vulnerability in Magento?
To fix the incorrect authorization vulnerability in Magento, update to version 2.4.1 or a later version.