Vulnerability advisory

CVE-2020-24405

Published Nov 9, 2020Updated Oct 24, 2026OSV record ↗

Also known as BIT-magento-2020-24405GHSA-p7m7-j8jv-393q

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/devdocs ↗
All commits before b69fab3da87a1536e1a583e51c8115e3f843609b	`b69fab3da87a1536e1a583e51c8115e3f843609b`
b69fab3da87a1536e1a583e51c8115e3f843609b through b69fab3da87a1536e1a583e51c8115e3f843609b	No fix listed
Also listed as affected (18) `2.3.5-NA` `2.3.0` `2.2.7` `2.1.16` `2.3.4` `2.3.3-p1` `2.2.11` `2.3.2` `2.2.9` `2.1.18` `2.3.1` `2.2.8` `2.1.17` `2.2.6` `2.1.15` `2.2.5` `2.1.14` `2.0.8`
GIT github.com/magento/magento2 ↗
All commits before dcc962efc5ad12717c6eac0f10cf822780dd3f4a	`dcc962efc5ad12717c6eac0f10cf822780dd3f4a`
dcc962efc5ad12717c6eac0f10cf822780dd3f4a through 6729b6e01368248abc33300208eb292c95050203	No fix listed
Also listed as affected (40) `2.3.5-NA` `2.3.5-p1` `2.4.0` `2.3.4` `2.3.3` `2.3.2` `2.3.1` `2.3.0` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb20-59.html ↗