CVE-2020-24405CWE-285

Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data

Medium · published November 9, 2020

CVSS v3.1
4.3
EPSS
2%
Percentile
74.4
In the wild
Unconfirmed
What it is

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01519 · 74.4th percentile
Weakness
CWE-285 · Improper Authorization
Published
2020-11-09T00:39Z
EPSS history
Timeline
  • 09 NOV 00:39Z
    Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data
    cvelistv5