CVE-2020-24403: Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
First published: Thu Oct 01 2020(Updated: )
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.
Credit: psirt@adobe.com psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/community-edition | =2.4.0 | 2.4.1 |
| composer/magento/community-edition | <2.3.6 | 2.3.6 |
| Magento Magento | <2.3.5 | |
| Magento Magento | <2.3.5 | |
| Magento Magento | =2.3.5 | |
| Magento Magento | =2.3.5 | |
| Magento Magento | =2.3.5-p1 | |
| Magento Magento | =2.3.5-p1 | |
| Magento Magento | =2.4.0 | |
| Magento Magento | =2.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-24403?
CVE-2020-24403 is a vulnerability in Magento version 2.4.0 and 2.3.5p1 (and earlier) that allows authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data.
How severe is CVE-2020-24403?
CVE-2020-24403 has a severity rating of 2.7, which is considered medium.
Which versions of Magento are affected by CVE-2020-24403?
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by CVE-2020-24403.
How can the vulnerability CVE-2020-24403 be exploited?
Authenticated users with Inventory and Source permissions can exploit CVE-2020-24403 to make unauthorized changes to inventory source data.
Is there a fix available for CVE-2020-24403?
Yes, a fix is available for CVE-2020-24403. It is recommended to update to the latest version of Magento to mitigate this vulnerability.
- collector/nvd-index
- agent/type
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-39rw-4m66-82gf
- alias/CVE-2020-24403
- agent/software-canonical-lookup
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/magento
- canonical/magento magento
- version/magento magento/2.3.5
- version/magento magento/2.3.5-p1
- version/magento magento/2.4.0
- package-manager/composer