title: Magento Commerce Incorrect permissions Could Lead To Unauthorized Access
description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
problem types: Improper Authorization (CWE-285)
affected:
{
product: Magento Commerce
vendor: Adobe
versions:
lessThanOrEqual: 2.4.1, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 2.4.0-p1, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 2.3.6, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: None, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.0
]