CVE-2020-24404

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.

Score

CVSS 3.1 2.7 Low

Status

Modified - psirt@adobe.com

Published

2020-11-09

Last modified

2024-09-16

Weaknesses

CWE-285

Affected products

• Magento Commerce (Adobe)
• Magento (Magento)

References

• https://helpx.adobe.com/security/products/magento/apsb20-59.html