Incorrect permissions in the Integrations component could lead to unauthorized deletion of customer details via REST API (Adobe Magento Commerce)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.70 % · percentile 77 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Modified
Description
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability in the Integrations component. This vulnerability could be abused by authenticated users with permissions to the Resource Access API to delete customer details via the REST API without authorization.
Weaknesses (CWE)
- CWE-276 — Incorrect Default Permissions
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | adobe |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | NVD · psirt@adobe.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Secondary) |
| CVSS 2.0 | MEDIUM 5.5 | AV:N/AC:L/Au:S/C:N/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-hvf5-4jr9-fghh — Magento incorrect permissions vulnerability in the Integrations component
European references
- ENISA EUVD · EUVD-2022-4218
- GCVE · GCVE-0-2020-24402
CERT-FR advisories
- CERTFR-2020-AVI-648 — Multiples vulnérabilités dans Magento · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*< 2.3.5cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*< 2.3.5cpe:2.3:a:magento:magento:2.3.5:-:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.3.5:-:*:*:open_source:*:*:*cpe:2.3:a:magento:magento:2.3.5:p1:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.3.5:p1:*:*:open_source:*:*:*cpe:2.3:a:magento:magento:2.4.0:*:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.4.0:*:*:*:open_source:*:*:*
Affected products
| Product | Versions |
|---|---|
| Adobe · Magento Commerce | affected unspecified ≤ 2.4.0 ; affected unspecified ≤ 2.3.5p1 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |