Vulnerability · Published Jan 27, 2023 · Assigned by GitHub_M
CVE-2021-21395Magneto-lts vulnerable to Cross-Site Request Forgery
Medium 4.2
In plain English
A medium-severity cross-site request forgery in magento-lts from OpenMage. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | openmage/magento-lts | 19.4.22 | GHSA-r3c9-9j5q-pwv4 |
| Packagist | openmage/magento-lts | 20.0.19 | GHSA-r3c9-9j5q-pwv4 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OpenMage | magento-lts | < 19.4.22>= 20.0.0, < 20.0.19 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
References
- https://github.com/OpenMage/magento-lts/security/advisories/GHSA-r3c9-9j5q-pwv4 x_refsource_CONFIRM
- https://hackerone.com/reports/1086752 x_refsource_MISC
- https://packagist.org/packages/openmage/magento-lts x_refsource_MISC