Vulnerability advisory

CVE-2020-24402

Published Nov 9, 2020Updated Oct 24, 2026OSV record ↗

Also known as BIT-magento-2020-24402GHSA-hvf5-4jr9-fghh

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/devdocs ↗
All commits before b69fab3da87a1536e1a583e51c8115e3f843609b	`b69fab3da87a1536e1a583e51c8115e3f843609b`
b69fab3da87a1536e1a583e51c8115e3f843609b through b69fab3da87a1536e1a583e51c8115e3f843609b	No fix listed
Also listed as affected (18) `2.3.5-NA` `2.3.0` `2.2.7` `2.1.16` `2.3.4` `2.3.3-p1` `2.2.11` `2.3.2` `2.2.9` `2.1.18` `2.3.1` `2.2.8` `2.1.17` `2.2.6` `2.1.15` `2.2.5` `2.1.14` `2.0.8`
GIT github.com/magento/magento2 ↗
All commits before dcc962efc5ad12717c6eac0f10cf822780dd3f4a	`dcc962efc5ad12717c6eac0f10cf822780dd3f4a`
dcc962efc5ad12717c6eac0f10cf822780dd3f4a through 6729b6e01368248abc33300208eb292c95050203	No fix listed
Also listed as affected (40) `2.3.5-NA` `2.3.5-p1` `2.4.0` `2.3.4` `2.3.3` `2.3.2` `2.3.1` `2.3.0` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb20-59.html ↗