PT-2020-4511 · Adobe · Magento

Published 2020-10-15 · Updated 2024-03-06 · CVE-2020-24401

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Magento versions 2.4.0 and 2.3.5p1 (and earlier)

Description The issue is related to incorrect authorization, allowing a user to access resources provisioned under their old role even after an administrator removes the role or disables the user's account. This can enable a remote attacker to gain unauthorized access to protected information.

Recommendations For Magento versions 2.4.0 and 2.3.5p1 (and earlier), consider temporarily restricting access to sensitive resources until a patch is available. As a temporary workaround, consider disabling the role provisioning feature until a fix is released. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2020-05060

BIT-MAGENTO-2020-24401

CVE-2020-24401

GHSA-F2G3-3C6Q-4478

Affected Products

Magento

References · 9

• https://osv.dev/vulnerability/BIT-magento-2020-24401 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb20-59.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05060 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24401 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24401 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f2g3-3c6q-4478 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://cert.civis.net/en/index.php?action=alert&param=CVE-2020-24401 · Note
• https://cert.civis.net/en/index.php?action=alert&param=CVE-2020-24401 · Note