What is GHSA-rwf7-652f-76mv?

GHSA-rwf7-652f-76mv is a security advisory published by GitHub Security Advisories with Low severity. Magento 2 Community Edition vulnerable to Improper Authorization

Which CVE IDs does GHSA-rwf7-652f-76mv cover?

GHSA-rwf7-652f-76mv covers the following CVE IDs: CVE-2020-24404. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rwf7-652f-76mv?

GHSA-rwf7-652f-76mv has a CVSS v3 base score of 2.7, published by GitHub Security Advisories.

Which products are affected by GHSA-rwf7-652f-76mv?

GHSA-rwf7-652f-76mv affects 2 products, including: composer/magento/community-edition:\u003c 2.3.6; composer/magento/community-edition:= 2.4.0.

GHSA-rwf7-652f-76mvLowCVSS 2.7

Magento 2 Community Edition vulnerable to Improper Authorization

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

July 20, 2023

🔗 CVE IDs covered (1)

CVE-2020-24404 →

📋 Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.

🎯 Affected products2

composer/magento/community-edition:< 2.3.6
composer/magento/community-edition:= 2.4.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-24404
https://helpx.adobe.com/security/products/magento/apsb20-59.html
https://devdocs.magento.com/guides/v2.3/release-notes/open-source-2-3-6.html
https://experienceleague.adobe.com/docs/commerce-operations/release/notes/magento-open-source/2-4-1.html
https://github.com/advisories/GHSA-rwf7-652f-76mv