CVE-2020-24404 Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API

🗓️ 09 Nov 2020 00:40:04Reported by adobeType

Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API. Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2020-24404	1 Oct 202023:00	–	attackerkb
BDU FSTEC	The vulnerability of the integration component of the Magento Commerce software development and management platform, related to authentication errors, allows a malicious user to delete CMS pages via the REST API without authentication.	17 Nov 202000:00	–	bdu_fstec
CNVD	Adobe Magento Improper Authorization Vulnerability	20 Oct 202000:00	–	cnvd
CVE	CVE-2020-24404	9 Nov 202000:40	–	cve
EUVD	EUVD-2022-5243	3 Oct 202520:07	–	euvd
Github Security Blog	Magento 2 Community Edition vulnerable to Improper Authorization	24 May 202217:33	–	github
NVD	CVE-2020-24404	9 Nov 202001:15	–	nvd
OpenVAS	Magento < 2.3.6, 2.4.x < 2.4.1 Multiple Vulnerabilities (APSB20-59)	23 Oct 202000:00	–	openvas
OSV	BIT-MAGENTO-2020-24404 Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API	6 Mar 202411:07	–	osv
OSV	GHSA-RWF7-652F-76MV Magento 2 Community Edition vulnerable to Improper Authorization	24 May 202217:33	–	osv

[
  {
    "product": "Magento Commerce",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "2.4.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.3.5p1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "None",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
helpx	www.helpx.adobe.com/security/products/magento/apsb20-59.html

09 Nov 2020 00:40Current

3.6Low risk

Vulners AI Score3.6

CVSS 3.12.7

EPSS0.00273

CWE-285