CVE-2021-21395

low-risk
Published 2023-01-27

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.

Do I need to act?

-
0.09% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.2/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

Magento

Affected Vendors

Openmage

References (6)

Third Party Advisory https://github.com/OpenMage/magento-lts/security/advisories/GHSA-r3c9-9j5q-pwv4
Exploit https://hackerone.com/reports/1086752
Third Party Advisory https://packagist.org/packages/openmage/magento-lts
Third Party Advisory https://github.com/OpenMage/magento-lts/security/advisories/GHSA-r3c9-9j5q-pwv4
Exploit https://hackerone.com/reports/1086752
Third Party Advisory https://packagist.org/packages/openmage/magento-lts
19
/ 100
low-risk
Severity 14/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal