4.3

CVE-2021-39864

Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Commerce Version <= 2.3.7
Adobe ≫ Commerce Version 2.3.7 Update p1
Adobe ≫ Commerce Version 2.4.2
Adobe ≫ Commerce Version 2.4.2 Update p1
Adobe ≫ Commerce Version 2.4.2 Update p2
Adobe ≫ Commerce Version 2.4.3
Adobe ≫ Magento Open Source Version <= 2.3.7
Adobe ≫ Magento Open Source Version 2.3.7 Update p1
Adobe ≫ Magento Open Source Version 2.4.2
Adobe ≫ Magento Open Source Version 2.4.2 Update p1
Adobe ≫ Magento Open Source Version 2.4.2 Update p2
Adobe ≫ Magento Open Source Version 2.4.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.62% 0.738
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
Adobe 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://helpx.adobe.com/security/products/magento/apsb21-86.html
Vendor Advisory
Release Notes