CVE-2021-39864

Опубликовано: 15 окт. 2021

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

Ссылки

https://helpx.adobe.com/security/products/magento/apsb21-86.html
Release Notes
Vendor Advisory
https://helpx.adobe.com/security/products/magento/apsb21-86.html
Release Notes
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*

Версия до 2.3.7 (включая)

cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.2:*:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.2:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.2:p2:*:*:*:*:*:*

cpe:2.3:a:adobe:commerce:2.4.3:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*

Версия до 2.3.7 (включая)

cpe:2.3:a:adobe:magento_open_source:2.3.7:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:magento_open_source:2.4.2:*:*:*:*:*:*:*

cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*

cpe:2.3:a:adobe:magento_open_source:2.4.2:p2:*:*:*:*:*:*

cpe:2.3:a:adobe:magento_open_source:2.4.3:*:*:*:*:*:*:*

EPSS

Процентиль: 75%

0.00863

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

GHSA-94wq-87g6-8h77