CVE-2020-24404

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-24404

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24404.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-24404

Aliases

Published

2020-11-09T01:15:12Z

Modified

2026-10-20T10:52:51Z

Severity

2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:a:magento:magento:2.3.5:p1:*:*:commerce:*:*:*",
                "cpe:2.3:a:magento:magento:2.3.5:p1:*:*:open_source:*:*:*",
                "cpe:2.3:a:magento:magento:2.4.0:*:*:*:commerce:*:*:*",
                "cpe:2.3:a:magento:magento:2.4.0:*:*:*:open_source:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2.3.5-p1"
                        },
                        {
                            "last_affected":  "2.3.5-p1"
                        },
                        {
                            "introduced":  "2.3.5-p1"
                        },
                        {
                            "last_affected":  "2.3.5-p1"
                        },
                        {
                            "introduced":  "2.4.0"
                        },
                        {
                            "last_affected":  "2.4.0"
                        },
                        {
                            "introduced":  "2.4.0"
                        },
                        {
                            "last_affected":  "2.4.0"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "magento:magento"
        }
    ]
}

References

https://helpx.adobe.com/security/products/magento/apsb20-59.html

Affected packages

Git / github.com/magento/devdocs

Affected ranges

Type

GIT

Repo

https://github.com/magento/devdocs

Events

Introduced

Fixed

b69fab3da87a1536e1a583e51c8115e3f843609b

Introduced

b69fab3da87a1536e1a583e51c8115e3f843609b

Last Affected

b69fab3da87a1536e1a583e51c8115e3f843609b

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.3.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.3.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:magento:magento:2.3.5:-:*:*:commerce:*:*:*",
            "range":  [
                {
                    "introduced":  "2.3.5-NA"
                },
                {
                    "last_affected":  "2.3.5-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:magento:magento:2.3.5:-:*:*:open_source:*:*:*",
            "range":  [
                {
                    "introduced":  "2.3.5-NA"
                },
                {
                    "last_affected":  "2.3.5-NA"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

2.*

2.0.8

2.1.14

2.1.15

2.1.16

2.1.17

2.1.18

2.2.11

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.3.0

2.3.1

2.3.2

2.3.3-p1

2.3.4

2.3.5-NA

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24404.json"

Git / github.com/magento/magento2

Affected ranges

Type

GIT

Repo

https://github.com/magento/magento2

Events

Introduced

Fixed

dcc962efc5ad12717c6eac0f10cf822780dd3f4a

Introduced

dcc962efc5ad12717c6eac0f10cf822780dd3f4a

Last Affected

6729b6e01368248abc33300208eb292c95050203

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.3.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2.3.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:magento:magento:2.3.5:-:*:*:commerce:*:*:*",
            "range":  [
                {
                    "introduced":  "2.3.5-NA"
                },
                {
                    "last_affected":  "2.3.5-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:magento:magento:2.3.5:-:*:*:open_source:*:*:*",
            "range":  [
                {
                    "introduced":  "2.3.5-NA"
                },
                {
                    "last_affected":  "2.3.5-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:magento:magento:2.3.5:p1:*:*:commerce:*:*:*",
            "range":  [
                {
                    "introduced":  "2.3.5-p1"
                },
                {
                    "last_affected":  "2.3.5-p1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:magento:magento:2.3.5:p1:*:*:open_source:*:*:*",
            "range":  [
                {
                    "introduced":  "2.3.5-p1"
                },
                {
                    "last_affected":  "2.3.5-p1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:magento:magento:2.4.0:*:*:*:commerce:*:*:*",
            "range":  [
                {
                    "introduced":  "2.4.0"
                },
                {
                    "last_affected":  "2.4.0"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:magento:magento:2.4.0:*:*:*:open_source:*:*:*",
            "range":  [
                {
                    "introduced":  "2.4.0"
                },
                {
                    "last_affected":  "2.4.0"
                }
            ],
            "source":  "CPE_STRING"
        }
    ]
}

Affected versions

0.*

0.1.0-alpha100

0.1.0-alpha101

0.1.0-alpha102

0.1.0-alpha103

0.1.0-alpha104

0.1.0-alpha105

0.1.0-alpha106

0.1.0-alpha107

0.1.0-alpha108

0.1.0-alpha89

0.1.0-alpha90

0.1.0-alpha91

0.1.0-alpha92

0.1.0-alpha93

0.1.0-alpha94

0.1.0-alpha95

0.1.0-alpha96

0.1.0-alpha97

0.1.0-alpha98

0.1.0-alpha99

0.42.0-beta1

0.42.0-beta3

0.74.0-beta1

2.*

2.0.0

2.0.0-rc

2.1.0

2.1.0-rc1

2.1.0-rc2

2.1.0-rc3

2.2.0-RC1.1

2.2.0-RC1.2

2.2.0-RC1.3

2.3.0

2.3.1

2.3.2

2.3.3

2.3.4

2.3.5-NA

2.3.5-p1

2.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24404.json"