4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2020-24405

GHSA ID

GHSA-p7m7-j8jv-393q

EPSS Score

0.32398%

CWE

CWE-285

Published

5/24/2022

Updated

1/11/2024

KEV Status

Technology

PHP

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2020-24405

CVE-2020-24405: Magento incorrect permissions vulnerability in the Inventory module

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions issue vulnerability in the Inventory module. This vulnerability could be abused by authenticated users to modify inventory stock data without authorization.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2020-24405

CVE-2020-24405:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2020-24405

GHSA ID

GHSA-p7m7-j8jv-393q

EPSS Score

0.32398%

CWE

CWE-285

Published

5/24/2022

Updated

1/11/2024

KEV Status

Technology

PHP

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
magento/community-edition	composer	<= 2.3.5-p2	2.3.6
magento/community-edition	composer	>= 2.4.0, < 2.4.1	2.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability centers on improper authorization in the Inventory module. Magento typically uses controller ACL checks via _isAllowed() methods and interface-level permissions. For CVE-2020-24405:

The Save controller action (Execute method) is a common attack vector for inventory modifications and would require explicit authorization checks that might have been missing.
StockRepositoryInterface::Save is a core API method for inventory updates; improper exposure via web APIs without role-based restrictions could enable unauthorized access. The medium confidence for the second function stems from less specific evidence in public advisories, but it aligns with the vulnerability pattern.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2020-24405: Magento incorrect permissions vulnerability in the Inventory module

CVE-2020-24405:

4.3

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

CVE-2020-24405: Magento incorrect permissions vulnerability in the Inventory module

4.3

4.3

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI