Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-24404

CVE-2020-24404: Magento 2 Community Edition vulnerable to Improper Authorization

2.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-24404
GHSA ID
GHSA-rwf7-652f-76mv
EPSS Score
0.50585%
CWE
CWE-285
Published
5/24/2022
Updated
7/20/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
magento/community-editioncomposer< 2.3.62.3.6
magento/community-editioncomposer= 2.4.02.4.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability arises from improper authorization in the Integrations component, specifically allowing users with 'Pages' resource access to delete CMS pages via REST API. The primary failure points are: 1) The controller action (execute()) for deletion lacked granular permission checks, and 2) The webapi.xml configuration for the delete endpoint referenced a broad resource ('Magento_Cms::page') instead of a delete-specific ACL. These issues allowed bypassing proper authorization checks. The functions are identified based on Magento's structure, where API endpoints map to controller/service methods, and authorization is enforced via ACL resources in webapi.xml.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

M***nto v*rsion *.*.* *n* *.*.*p* (*n* **rli*r) *r* *****t** *y *n in*orr**t p*rmissions vuln*r**ility wit*in t** Int**r*tions *ompon*nt. T*is vuln*r**ility *oul* ** **us** *y us*rs wit* p*rmissions to t** P***s r*sour** to **l*t* *ms p***s vi* t** R

Reasoning

T** vuln*r**ility *ris*s *rom improp*r *ut*oriz*tion in t** Int**r*tions *ompon*nt, sp**i*i**lly *llowin* us*rs wit* 'P***s' r*sour** ****ss to **l*t* *MS p***s vi* R*ST *PI. T** prim*ry **ilur* points *r*: *) T** *ontroll*r **tion (`*x**ut*()`) *or