CVE-2020-24405: medium-severity vulnerability in Adobe Magento Commerce
Incorrect permissions in Inventory module could lead to unauthorized modification of inventory stock data
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.3epss 1.5%
Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected products
Adobe · Magento CommerceRelated CVEs — Adobe Magento Commerce
In the same product, most dangerous first.
CVE-2022-24086CRITICALAdobe Commerce checkout improper input validation leads to remote code executionEPSS 99.2%KEVCVE-2021-21029MEDIUMMagento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript ExecutionEPSS 84.6%CVE-2022-34258MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 69.9%CVE-2023-22249MEDIUMAdobe Commerce Stored XSS Arbitrary code executionEPSS 58.5%CVE-2022-35698CRITICALAdobe Commerce Stored XSS Arbitrary code executionEPSS 14.7%CVE-2021-21064MEDIUMMagento UPWARD-php Path traversal vulnerability via UPWARD ConnectorEPSS 8.5%