CVE-2021-21395: Magneto-lts vulnerable to Cross-Site Request Forgery
Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-21395?
CVE-2021-21395 is a vulnerability in Magneto LTS (Long Term Support) that allows for Cross-Site Request Forgery attacks.
How does CVE-2021-21395 affect OpenMage Magento LTS?
Versions prior to 19.4.22 and 20.0.19 of OpenMage Magento LTS are affected by CVE-2021-21395.
How severe is CVE-2021-21395?
CVE-2021-21395 has a severity rating of 4.3, which is considered medium.
What is Cross-Site Request Forgery (CSRF)?
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request, unknowingly performing an action on their behalf.
How can I mitigate the risk of CSRF in OpenMage Magento LTS?
To mitigate the risk of CSRF in OpenMage Magento LTS, make sure to update to the latest version (19.4.22 or 20.0.19) and follow any security advisories provided by the OpenMage project.