CVE-2021-21395

Katalog CVE

CVSS 4.3 · Medium EPSS 0,38%

Kerentanan Cross-Site Request Forgery (CSRF) pada openmage magento. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.

Rincian

Terbit di NVD

27 Januari 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-r3c9-9j5q-pwv4 advisory pihak ketiga
• https://hackerone.com/reports/1086752 exploit · advisory pihak ketiga
• https://packagist.org/packages/openmage/magento-lts advisory pihak ketiga