CVE-2020-24403CWE-285

Incorrect permissions could lead to unauthorized modification of inventory source data via REST API

Low · published November 9, 2020

CVSS v3.1
2.7
EPSS
2%
Percentile
76.0
In the wild
Unconfirmed
What it is

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01630 · 76.0th percentile
Weakness
CWE-285 · Improper Authorization
Published
2020-11-09T00:39Z
EPSS history
Timeline
  • 09 NOV 00:39Z
    Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
    cvelistv5