PT-2020-4580 · Adobe · Magento

Published 2020-10-15 · Updated 2024-03-06 · CVE-2020-24405

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Magento versions 2.4.0 and 2.3.5p1 (and earlier)

Description The issue is related to an incorrect permissions problem in the Inventory module, which could be exploited by authenticated users to modify inventory stock data without proper authorization. This vulnerability is associated with authentication errors and can be exploited remotely to impact the integrity of protected information.

Recommendations For Magento versions 2.4.0 and 2.3.5p1 (and earlier), consider restricting access to the Inventory module until a fix is available. As a temporary workaround, limit the permissions of authenticated users to prevent unauthorized modification of inventory stock data.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2020-05129

BIT-MAGENTO-2020-24405

CVE-2020-24405

GHSA-P7M7-J8JV-393Q

Affected Products

Magento

References · 10

• https://osv.dev/vulnerability/GHSA-p7m7-j8jv-393q · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb20-59.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05129 · Security Note
• https://osv.dev/vulnerability/BIT-magento-2020-24405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24405 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24405 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://cert.civis.net/en/index.php?action=alert&param=CVE-2020-24405 · Note
• https://cert.civis.net/en/index.php?action=alert&param=CVE-2020-24405 · Note
• https://cybersecurity-help.cz/vdb/SB2020101517 · Note