CVE-2021-21395

 

Published at: - 27-01-2023 05:15

Last modified: - 27-01-2023 08:12

Total changes: - 1

Description

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://packagist.org/packages/openmage/magento-lts
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-r3c9-9j5q-pwv4
• https://hackerone.com/reports/1086752

 

Keywords

NVD

 

CVE-2021-21395

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures