CVE-2021-39864

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-39864
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39864.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-39864
Aliases
Published
2021-10-15T15:15:08.460Z
Modified
2026-07-08T22:14:09.300569Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

References

Affected packages

Git / github.com/magento/magento2

Affected ranges

Type
GIT
Repo
https://github.com/magento/magento2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
44a7b6079bcac5ba92040b16f4f74024b4f34d09
Introduced
3c90474cbeac29921594ab97e68ca0502b5827a0
Last affected
4c36116dcf878e127059d9be9566a119783583f2
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento_open_source:2.3.7:p1:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:commerce:2.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento_open_source:2.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:commerce:2.4.2:p1:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:commerce:2.4.2:p2:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento_open_source:2.4.2:p2:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:commerce:2.4.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento_open_source:2.4.3:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.7"
        },
        {
            "introduced": "2.3.7-p1"
        },
        {
            "last_affected": "2.3.7-p1"
        },
        {
            "introduced": "2.4.2"
        },
        {
            "last_affected": "2.4.2"
        },
        {
            "introduced": "2.4.2-p1"
        },
        {
            "last_affected": "2.4.2-p1"
        },
        {
            "introduced": "2.4.2-p2"
        },
        {
            "last_affected": "2.4.2-p2"
        },
        {
            "introduced": "2.4.3"
        },
        {
            "last_affected": "2.4.3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

0.*
0.1.0-alpha100
0.1.0-alpha101
0.1.0-alpha102
0.1.0-alpha103
0.1.0-alpha104
0.1.0-alpha105
0.1.0-alpha106
0.1.0-alpha107
0.1.0-alpha108
0.1.0-alpha89
0.1.0-alpha90
0.1.0-alpha91
0.1.0-alpha92
0.1.0-alpha93
0.1.0-alpha94
0.1.0-alpha95
0.1.0-alpha96
0.1.0-alpha97
0.1.0-alpha98
0.1.0-alpha99
0.42.0-beta1
0.42.0-beta3
0.74.0-beta1
2.*
2.0.0
2.0.0-rc
2.1.0
2.1.0-rc1
2.1.0-rc2
2.1.0-rc3
2.2.0-RC1.1
2.2.0-RC1.2
2.2.0-RC1.3
2.3.7
2.3.7-p1
2.4.2
2.4.2-p1
2.4.2-p2
2.4.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-39864.json"