Vulnerability advisory

CVE-2021-21395

Published Jan 27, 2023Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/openmage/magento-lts ↗
All commits before d28003ffa21be11591a7182840abc7b44bdf7d14	`d28003ffa21be11591a7182840abc7b44bdf7d14`
16c8e84ddaf5d54eef1e025a241bdd5f9a60bd6f to before e527e810970798b7c1ecfe1cf8d20a3e7a9aa238	`e527e810970798b7c1ecfe1cf8d20a3e7a9aa238`
Also listed as affected (93) `v20.0.18` `v19.4.21` `v19.4.20` `v20.0.17` `v19.4.19` `v20.0.16` `v19.4.18` `v20.0.15` `v19.4.16` `v20.0.13` `v19.4.15` `v20.0.12` `v20.0.11` `v19.4.14` `v20.0.10` `v19.4.13` `v20.0.8` `v19.4.12` `v20.0.7` `v19.4.11` `v20.0.6` `v19.4.10` `v20.0.5` `v19.4.9` `v20.0.4` `v19.4.8` `v20.0.3` `v19.4.7` `v20.0.2` `v19.4.6` `v20.0.1` `v19.4.5` `v20.0.0` `v19.4.4` `v19.4.3` `v19.4.2` `v19.4.1` `v19.4.0` `1.9.0.1` `1.9.1.1` `1.9.1.0-lts` `1.9.0.0` `1.8.1.0` `1.7.0.2` `1.7.0.1` `1.7.0.0` `1.6.1.0` `1.6.0.0` `1.6.0.0-rc2` `1.6.0.0-rc1` `1.6.0.0-beta1` `1.6.0.0-alpha1` `1.5.1.0` `1.5.0.1` `1.5.0.0` `1.5.0.0-rc2` `1.5.0.0-rc1` `1.5.0.0-beta2` `1.5.0.0-beta1` `1.5.0.0-alpha2` `1.5.0.0-alpha1` `1.4.2.0` `1.4.1.1` `1.4.1.0` `1.4.0.1` `1.3.2.4` `1.4.0.0` `1.4.0.0-rc1` `1.4.0.0-beta1` `1.4.0.0-alpha3` `1.4.0.0-alpha2` `1.4.0.0-alpha1` `1.3.2.3` `1.3.2.2` `1.3.2.1` `1.3.2` `1.3.1.1` `1.3.1` `1.3.0` `1.2.1.2` `1.2.1` `1.2.0.3` `1.2.0.2` `1.2.0.1` `1.2.0` `1.1.8` `1.1.7` `1.1.6` `1.1.5` `1.1.4` `1.1.3` `1.1.2` `1.1.1`

Description

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.

CVE-2021-21395

Affected versions

Repository

Description

References