What is GHSA-hvf5-4jr9-fghh?

GHSA-hvf5-4jr9-fghh is a security advisory published by GitHub Security Advisories with Medium severity. Magento incorrect permissions vulnerability in the Integrations component

Which CVE IDs does GHSA-hvf5-4jr9-fghh cover?

GHSA-hvf5-4jr9-fghh covers the following CVE IDs: CVE-2020-24402. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hvf5-4jr9-fghh?

GHSA-hvf5-4jr9-fghh has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

Which products are affected by GHSA-hvf5-4jr9-fghh?

GHSA-hvf5-4jr9-fghh affects 3 products, including: composer/magento/community-edition:\u003c 2.3.6; composer/magento/community-edition:= 2.4.0; composer/magento/project-community-edition:\u003c= 2.0.2.

GHSA-hvf5-4jr9-fghhMediumCVSS 4.9

Magento incorrect permissions vulnerability in the Integrations component

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

February 10, 2025

🔗 CVE IDs covered (1)

CVE-2020-24402 →

📋 Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization.

🎯 Affected products3

composer/magento/community-edition:< 2.3.6
composer/magento/community-edition:= 2.4.0
composer/magento/project-community-edition:<= 2.0.2

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2020-24402
https://helpx.adobe.com/security/products/magento/apsb20-59.html
https://github.com/advisories/GHSA-hvf5-4jr9-fghh