{"id":"CVE-2021-39864","published":"2021-10-15T14:21:43Z","modified":"2025-04-23T19:25:18Z","title":"Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition","vendor":"Adobe","product":"Magento Commerce","tier":"tail","description":{"text":"Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.","provenance":"source","from":"CVE.org"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01619,"percentile":0.75972,"provenance":"source"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb21-86.html","tags":["x_refsource_MISC"]}],"priority":{"score":19.7,"factors":[{"name":"EPSS percentile","points":15.19},{"name":"CVSS severity","points":4.55}]},"vendorSlug":"adobe","affectedVersions":[{"vendor":"Adobe","product":"Magento Commerce","versions":[">= unspecified, <= 2.4.3",">= unspecified, <= 2.4.2-p2",">= unspecified, <= 2.3.7-p1",">= unspecified, <= None"]}],"affected":[{"ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.2-p1, <=2.4.2-p2","<2.3.7-p2"],"patched":["2.3.7-p2"],"from":["GHSA-94wq-87g6-8h77"],"provenance":"source"},{"ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"from":["GHSA-94wq-87g6-8h77"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-26221","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-9690","published":"2020-07-29","fixed":"2.3.5-p2","kev":false},{"cve":"CVE-2020-9691","published":"2020-07-29","fixed":"2.3.5-p2","kev":false},{"cve":"CVE-2020-9692","published":"2020-07-29","fixed":"2.3.5-p2","kev":false},{"cve":"CVE-2021-39864","published":"2021-10-15","fixed":"2.3.7-p2","kev":false},{"cve":"CVE-2020-24400","published":"2020-11-09","fixed":"2.4.1","kev":false},{"cve":"CVE-2020-24401","published":"2020-11-09","fixed":"2.4.1","kev":false},{"cve":"CVE-2020-24402","published":"2020-11-09","fixed":"2.4.1","kev":false},{"cve":"CVE-2022-24086","published":"2022-02-16","fixed":"2.4.3-p2","kev":true,"link":{"from":"CVE-2021-39864","to":"CVE-2022-24086","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:magento/community-edition","fromFixed":"2.3.7-p2","toFixed":"2.3.7-p3","daysApart":124}]}},{"cve":"CVE-2022-24093","published":"2023-09-12","fixed":"2.4.3-p2","kev":false,"link":{"from":"CVE-2021-39864","to":"CVE-2022-24093","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Packagist:magento/community-edition","fromFixed":"2.3.7-p2","toFixed":"2.3.7-p3","daysApart":697}]}}],"package":"Packagist:magento/community-edition"}}