PT-2020-4579 · Adobe · Magento

Published 2020-10-15 · Updated 2024-03-06 · CVE-2020-24403

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Magento versions 2.4.0 and 2.3.5p1 (and earlier)

Description The issue is related to incorrect user permissions within the Inventory component, allowing authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API. This vulnerability is associated with authorization errors, potentially impacting the confidentiality and integrity of protected information over the HTTP protocol.

Recommendations For Magento versions 2.4.0 and 2.3.5p1 (and earlier), consider restricting access to the Inventory component and its associated REST API endpoints to minimize the risk of exploitation. As a temporary workaround, limit the permissions of authenticated users to prevent unauthorized changes to inventory source data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2020-05128

BIT-MAGENTO-2020-24403

CVE-2020-24403

GHSA-39RW-4M66-82GF

Affected Products

Magento

References · 9

• https://osv.dev/vulnerability/CVE-2020-24403 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb20-59.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05128 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-24403 · Security Note
• https://osv.dev/vulnerability/GHSA-39rw-4m66-82gf · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2020-24403 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://cert.civis.net/en/index.php?action=alert&param=CVE-2020-24403 · Note
• https://cert.civis.net/en/index.php?action=alert&param=CVE-2020-24403 · Note