CVE-2021-39864CWE-352

Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition

Medium · published October 15, 2021

CVSS v3.1
6.5
EPSS
2%
Percentile
75.9
In the wild
Unconfirmed
What it is

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01619 · 75.9th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2021-10-15T14:21Z
EPSS history
Timeline
  • 15 OCT 14:21Z
    Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition
    cvelistv5