CVE-2020-24403
Incorrect permissions could lead to unauthorized modification of inventory source data via REST API
Vexday Risk Score
8Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 2.7EPSS 1.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
09 nov 2020Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect user permissions vulnerability within the Inventory component. This vulnerability could be abused by authenticated users with Inventory and Source permissions to make unauthorized changes to inventory source data via the REST API.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Productos afectados
Adobe · Magento Commerce¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →