CVE-2020-24405

MEDIUM4.3EPSS 0.09%

Magento incorrect permissions vulnerability in the Inventory module

Published: 5/24/2022Modified: 2/16/2024

Also known as:GHSA-p7m7-j8jv-393qBIT-magento-2020-24405

Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.

Affected packages (2)

Bitnami/magentofrom 0, < 2.3.5, >= 2.4.0, < 2.4.1
Packagist/magento/community-editionfrom 0, < 2.3.6

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-24405
PATCHhttps://github.com/magento/magento2
WEBhttps://helpx.adobe.com/security/products/magento/apsb20-59.html