6.5

CVE-2021-39864

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Commerce Version <= 2.3.7
Adobe ≫ Commerce Version2.3.7 Updatep1
Adobe ≫ Commerce Version2.4.2
Adobe ≫ Commerce Version2.4.2 Updatep1
Adobe ≫ Commerce Version2.4.2 Updatep2
Adobe ≫ Commerce Version2.4.3
Adobe ≫ Magento Open Source Version <= 2.3.7
Adobe ≫ Magento Open Source Version2.3.7 Updatep1
Adobe ≫ Magento Open Source Version2.4.2
Adobe ≫ Magento Open Source Version2.4.2 Updatep1
Adobe ≫ Magento Open Source Version2.4.2 Updatep2
Adobe ≫ Magento Open Source Version2.4.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.86% 0.729
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
psirt@adobe.com 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.