CVE-2020-24404
Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API
Vexday Risk Score
8Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 2.7EPSS 1.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
09 nov 2020Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Productos afectados
Adobe · Magento Commerce¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →