What is GHSA-39rw-4m66-82gf?

GHSA-39rw-4m66-82gf is a security advisory published by GitHub Security Advisories with Low severity. Magento incorrect user permissions vulnerability within the Inventory component

Which CVE IDs does GHSA-39rw-4m66-82gf cover?

GHSA-39rw-4m66-82gf covers the following CVE IDs: CVE-2020-24403. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-39rw-4m66-82gf?

GHSA-39rw-4m66-82gf has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

Which products are affected by GHSA-39rw-4m66-82gf?

GHSA-39rw-4m66-82gf affects 3 products, including: composer/magento/community-edition:\u003c 2.3.6; composer/magento/community-edition:= 2.4.0; composer/magento/project-community-edition:\u003c= 2.0.2.

GHSA-39rw-4m66-82gfLowCVSS 2.7

Magento incorrect user permissions vulnerability within the Inventory component

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

February 10, 2025

🔗 CVE IDs covered (1)

CVE-2020-24403 →

📋 Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.

🎯 Affected products3

composer/magento/community-edition:< 2.3.6
composer/magento/community-edition:= 2.4.0
composer/magento/project-community-edition:<= 2.0.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-24403
https://helpx.adobe.com/security/products/magento/apsb20-59.html
https://github.com/advisories/GHSA-39rw-4m66-82gf