{"id":"CVE-2020-24404","aliases":["BIT-magento-2020-24404","EUVD-2022-5243","GHSA-rwf7-652f-76mv"],"status":"published","title":"Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API","description":"Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01761,"percentile":0.78302,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2020-11-09T00:40:04Z","modified":"2026-10-24T10:30:58Z","fixes":[{"ecosystem":"Packagist","package":"magento/community-edition","fixed_in":["2.3.6","2.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"magento","fixed_in":["2.3.5","2.4.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"last_affected":"2.4.0"},{"fixed":"2.4.1"}]}],"versions":["2.4.0"]},{"source":"osv","ecosystem":"Bitnami","package":"magento","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.3.5"},{"introduced":"2.4.0"},{"fixed":"2.4.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.6"}]}],"versions":["0.1.0-alpha100","0.1.0-alpha101","0.1.0-alpha102","0.1.0-alpha103","0.1.0-alpha104","0.1.0-alpha105","0.1.0-alpha106","0.1.0-alpha107","0.1.0-alpha108","0.1.0-alpha89","0.1.0-alpha90","0.1.0-alpha91","0.1.0-alpha92","0.1.0-alpha93","0.1.0-alpha94","0.1.0-alpha95","0.1.0-alpha96","0.1.0-alpha97","0.1.0-alpha98","0.1.0-alpha99","0.42.0-beta1","0.42.0-beta10","0.42.0-beta11","0.42.0-beta2","0.42.0-beta3","0.42.0-beta4","0.42.0-beta5","0.42.0-beta6","0.42.0-beta7","0.42.0-beta8","0.42.0-beta9","0.74.0-beta1","0.74.0-beta10","0.74.0-beta11","0.74.0-beta12","0.74.0-beta13","0.74.0-beta14","0.74.0-beta15","0.74.0-beta16","0.74.0-beta2","0.74.0-beta3","0.74.0-beta4","0.74.0-beta5","0.74.0-beta6","0.74.0-beta7","0.74.0-beta8","0.74.0-beta9","1.0.0-beta","1.0.0-beta2","1.0.0-beta3","1.0.0-beta4","1.0.0-beta5","1.0.0-beta6","2.0.0","2.0.0-rc","2.0.0-rc2","2.0.1","2.0.10","2.0.11","2.0.12","2.0.13","2.0.14","2.0.15","2.0.16","2.0.17","2.0.18","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9","2.1.0","2.1.0-rc1","2.1.0-rc2","2.1.0-rc3","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.18","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9","2.2.0","2.2.1","2.2.10","2.2.11","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8","2.2.9","2.3.0","2.3.1","2.3.2","2.3.2-p2","2.3.3","2.3.3-p1","2.3.4","2.3.4-p2","2.3.5","2.3.5-p1","2.3.5-p2"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.1"}]}],"versions":["2.4.0","2.4.0-p1"]}],"products":[{"vendor":"adobe","product":"magento commerce"},{"vendor":"magento","product":"magento"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb20-59.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-24404","tags":["web","advisory"]},{"url":"https://devdocs.magento.com/guides/v2.3/release-notes/open-source-2-3-6.html","tags":["web"]},{"url":"https://experienceleague.adobe.com/docs/commerce-operations/release/notes/magento-open-source/2-4-1.html","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rwf7-652f-76mv"},{"url":"https://github.com/magento/magento2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-24404","title":"Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API","description":"Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.","status":"published","published":"2020-11-09T00:40:04.994Z","modified":"2024-09-16T17:47:57.272Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:35:54.468882Z"}],"euvd":[{"id":"EUVD-2022-5243","description":"Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.","status":"published","published":"2020-11-09T00:40:04Z","modified":"2024-09-16T17:47:57Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T00:55:38.742114Z"}],"ghsa":[{"id":"GHSA-rwf7-652f-76mv","title":"Magento 2 Community Edition vulnerable to Improper Authorization","description":"Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.","status":"published","published":"2022-05-24T17:33:55Z","modified":"2023-07-20T14:43:02Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:36:57.310051Z"}],"nvd":[{"id":"CVE-2020-24404","description":"Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.","status":"published","published":"2020-11-09T01:15:12.707Z","modified":"2026-06-17T03:05:30.527Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:06:21.80969Z"}],"osv":[{"id":"CVE-2020-24404","description":"Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.","status":"published","published":"2020-11-09T01:15:12.707Z","modified":"2026-10-24T10:30:58.678169427Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"GHSA-rwf7-652f-76mv","title":"Magento 2 Community Edition vulnerable to Improper Authorization","description":"Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.","status":"published","published":"2022-05-24T17:33:55Z","modified":"2024-02-16T08:23:45.542398Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"BIT-magento-2020-24404","title":"Incorrect permissions in Integrations component could lead to unauthorized deletion of cmsPages via REST API","description":"Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.","status":"published","published":"2024-03-06T11:07:52.679Z","modified":"2026-09-08T08:48:09.123753012Z","updated_at":"2026-11-02T15:28:32.645004Z"}]}}