GHSA-rwf7-652f-76mv

Magento 2 Community Edition vulnerable to Improper Authorization

Source: GitHub Advisory Database (reviewed) Low CVE-2020-24404

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	magento/community-edition	< 2.3.6	2.3.6
Packagist	magento/community-edition	>= 2.4.0, < 2.4.1	2.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-24404 advisory
https://devdocs.magento.com/guides/v2.3/release-notes/open-source-2-3-6.html web
https://experienceleague.adobe.com/docs/commerce-operations/release/notes/magento-open-source/2-4-1.html web
https://github.com/magento/magento2 package
https://helpx.adobe.com/security/products/magento/apsb20-59.html web