CVE-2021-39864: Magento Community Edition CSRF Vulnerability via Wishlist Share Link
Summary
CVE-2021-39864: Magento Open Source allows Cross-Site Request Forgery (CSRF). Affects magento/community-edition across 2 version ranges.
< 2.3.7-p2
>= 2.4.2-p1, <= 2.4.2-p2
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Magento is a widely-used open-source e-commerce platform that enables businesses to create and manage online stores. It offers a range of features including product management, customer management, and order processing. However, certain versions of Magento Community Edition are vulnerable to a cross-site request forgery (CSRF) vulnerability, which can be exploited by attackers to manipulate user sessions without authorization.
Vulnerability Detail
Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier), and 2.3.7p1 (and earlier) are susceptible to a CSRF vulnerability through a Wishlist Share Link. This vulnerability allows an unauthenticated attacker to add items to a customer's cart without their consent. The exploitation does not require access to the admin console, making it particularly dangerous as it can be executed by anyone with knowledge of the vulnerability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider disabling the Wishlist Share Link feature until the patch is applied. This can be done by modifying the configuration settings in the admin panel or by removing the related functionality from the frontend.
Conclusion
The CSRF vulnerability in Magento Community Edition poses a significant risk to online stores, allowing unauthorized actions without admin access. It is crucial for users to update to the patched versions to mitigate this risk and protect their customers.
See every vulnerability recorded for magento/community-edition →
FAQ
Cross-Site Request Forgery (CSRF) is a type of attack that tricks the victim into submitting a request that they did not intend to make, potentially leading to unauthorized actions.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
Successful exploitation of this vulnerability could lead to unauthorized items being added to a customer's cart, potentially resulting in financial loss and damage to customer trust.
No, access to the admin console is not required for successful exploitation, making this vulnerability particularly concerning.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
