CVE-2020-24404CWE-285

Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API

Low · published November 9, 2020

CVSS v3.1
2.7
EPSS
2%
Percentile
79.2
In the wild
Unconfirmed
What it is

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01869 · 79.2th percentile
Weakness
CWE-285 · Improper Authorization
Published
2020-11-09T00:40Z
EPSS history
Timeline
  • 09 NOV 00:40Z
    Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API
    cvelistv5