CVE-2020-24402CWE-276

Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API

Medium · published November 9, 2020

CVSS v3.1
4.9
EPSS
2%
Percentile
77.1
In the wild
Unconfirmed
What it is

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01703 · 77.1th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2020-11-09T00:39Z
EPSS history
Timeline
  • 09 NOV 00:39Z
    Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API
    cvelistv5