CVE-2020-24402

—

CVSS 3.1

4.9 medium

EPSS

2%p76

Published

Nov 9, 2020 (Nov 9, 2020)

Modified

Jun 17, 2026

Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization.

Vendors: magento
Products: magento
Ecosystems: E-commerce
Weakness: CWE-276
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.7%)

In the news1 stories

Adobe fixes Magento flaws that can lead to code execution

Security AffairsOct 16, 12:46 UTC · Oct 16, 2020Vulnerability CVE-2020-24407 CVE-2020-24400 CVE-2020-24402+7 CVEs