GHSA-94wq-87g6-8h77MediumCVSS 6.5

Magento Open Source allows Cross-Site Request Forgery (CSRF)

Published
May 24, 2022
Last Modified
March 4, 2025

🔗 CVE IDs covered (1)

CVE-2021-39864 →

📋 Description

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to a customer's cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

🎯 Affected products5

  • composer/magento/community-edition:>= 2.4.2-p1, <= 2.4.2-p2
  • composer/magento/community-edition:= 2.4.3
  • composer/magento/community-edition:<= 2.3.7-p1
  • composer/magento/community-edition:= 2.4.2
  • composer/magento/project-community-edition:<= 2.0.2

🔗 References (3)