p PatchFirst

CVE-2021-21395

CVE-2021-21395 · Magneto-lts vulnerable to Cross-Site Request Forgery

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.

CVSS 4.2 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • magento-lts

    Versions
    • < 19.4.22: Affected
    • >= 20.0.0, < 20.0.19: Affected

    No fix published

  • openmage/magento-lts Packagist

    Versions
    • 1.9.1.1
    • 1.9.2.0
    • 1.9.2.1
    • 1.9.2.2
    • 1.9.2.3
    • 1.9.2.4
    • 1.9.3.0
    • 1.9.3.1
    • v19.4.0
    • v19.4.1
    • v19.4.10
    • v19.4.11
    • v19.4.12
    • v19.4.13
    • v19.4.14
    • v19.4.15
    • v19.4.16
    • v19.4.17
    • v19.4.18
    • v19.4.19
    • v19.4.2
    • v19.4.20
    • v19.4.21
    • v19.4.3
    • v19.4.4
    • v19.4.5
    • v19.4.6
    • v19.4.7
    • v19.4.8
    • v19.4.9
    Affected ranges
    • ECOSYSTEM: < 19.4.22

    Update to 19.4.22

  • openmage/magento-lts Packagist

    Versions
    • v20.0.0
    • v20.0.1
    • v20.0.10
    • v20.0.11
    • v20.0.12
    • v20.0.13
    • v20.0.14
    • v20.0.15
    • v20.0.16
    • v20.0.17
    • v20.0.18
    • v20.0.2
    • v20.0.3
    • v20.0.4
    • v20.0.5
    • v20.0.6
    • v20.0.7
    • v20.0.8
    Affected ranges
    • ECOSYSTEM: ≥ 20.0.0, < 20.0.19

    Update to 20.0.19

Original sources

Check your server →