Authorization

Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account...

Design/Logic Flaw

Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization...

Authorization

Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization...

Remote code execution

Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components...

Information disclosure

Magento versions 2.4.0 and 2.3.5 and earlier are affected by an SQL Injection vulnerability that could lead to sensitive information disclosure. This vulnerability could be exploited by an authenticated user with permissions to the product listing page to read data from the database...

CVE-2020-24404

Summary (CVE-2020-24404): Magento Open Source platforms 2.4.0 and 2.3.5p1 (and earlier) have an incorrect permissions vulnerability in the Integrations component. It can be exploited by users who have Pages resource permissions to delete CMS pages via the REST API without authorization, exposing ...

CVE-2020-24404 Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API

Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization...

CVE-2020-24407 Arbitrary code execution via file import functionality

Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components...

CVE-2020-24407

CVE-2020-24407 affects Magento Open Source 2.4.x and 2.3.5p1 and earlier, with an unsafe file upload that enables arbitrary code execution when performed by authenticated admins with access to System/Data and Transfer/Import components. The issue is documented across multiple feeds (including OSV...

CVE-2020-24406 Document root path disclosure on Maintenance page

When in maintenance mode, Magento version 2.4.0 and 2.3.4 and earlier are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable...

CVE-2020-24406

CVE-2020-24406 affects Magento installations in maintenance mode for versions 2.4.0, 2.3.4 and earlier, exposing the installation path during build deployments. The vulnerability is an information disclosure that could aid an attacker in identifying other exploitable issues in the environment. Co...

CVE-2020-24405 Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data

Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization...

CVE-2020-24405

CVE-2020-24405 affects Magento Open Source (Magento) 2.4.0 and 2.3.5p1 (and earlier) in the Inventory module. The root cause described across connected sources is an incorrect permissions issue that could allow an authenticated user to modify inventory stock data without authorization. The availa...

CVE-2020-24403 Incorrect permissions could lead to unauthorized modification of inventory source data via REST API

Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the...

CVE-2020-24403

CVE-2020-24403 affects Magento Magento Open Source 2.4.0 and 2.3.5p1 (and earlier) with an incorrect user permissions vulnerability in the Inventory component. The issue allows authenticated users with Inventory and Source permissions to perform unauthorized changes to inventory source data via t...

CVE-2020-24401 Incorrect permissions following the deletion of a user role or deactivation of a user

Magento versions 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account...

CVE-2020-24401

CVE-2020-24401 — Magento : Affected are Magento versions 2.4.0 and 2.3.5p1 (and earlier). Root cause: incorrect authorization that lets a user continue to access resources provisioned under their old role after an administrator removes the role or disables the account. Impact: accounts may retain...

CVE-2020-24402

Magento 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. The issue allows authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization. This is rooted in impro...

CVE-2020-24402 Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API

Magento version 2.4.0 and 2.3.5p1 and earlier are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorizati...

CVE-2020-24400

CVE-2020-24400 affects Magento Open Source/Magento variants prior to fixed versions, specifically Magento 2.4.0, 2.3.5 and earlier. The vulnerability is an SQL injection that can lead to sensitive information disclosure . Exploitation requirements: an authenticated user with permissions to the pr...