CVE-2021-21027CWE-352

Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification

Medium · published February 11, 2021

CVSS v3.0
4.3
EPSS
2%
Percentile
76.5
In the wild
Unconfirmed
What it is

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01661 · 76.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-02-11T19:29Z
EPSS history
Timeline
  • 11 FEB 19:29Z
    Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification
    cvelistv5