CVE-2021-21395: magento-lts Reset Password not protected against well-timed CSRF
Impact
Password reset form is vulnerable to CSRF between time reset password link is clicked and user submits new password.
Patches
PR forthcoming
Workarounds
None
Other sources
magento-lts Reset Password not protected against well-timed CSRF
— Packagist
Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 20.0.19 - Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 19.4.22 - Upgrade
Upgrade
magento-ltsto a version that resolves this vulnerability.Fixed in 19.4.22 - Upgrade
Upgrade
magento-ltsto a version that resolves this vulnerability.Fixed in 20.0.19
Event History
Frequently Asked Questions
What is CVE-2021-21395?
CVE-2021-21395 is a vulnerability in Magneto LTS (Long Term Support) that allows for Cross-Site Request Forgery attacks.
How does CVE-2021-21395 affect OpenMage Magento LTS?
Versions prior to 19.4.22 and 20.0.19 of OpenMage Magento LTS are affected by CVE-2021-21395.
How severe is CVE-2021-21395?
CVE-2021-21395 has a severity rating of 4.3, which is considered medium.
What is Cross-Site Request Forgery (CSRF)?
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request, unknowingly performing an action on their behalf.
How can I mitigate the risk of CSRF in OpenMage Magento LTS?
To mitigate the risk of CSRF in OpenMage Magento LTS, make sure to update to the latest version (19.4.22 or 20.0.19) and follow any security advisories provided by the OpenMage project.