CVE-2021-39864 - Vulnerability Details - OpenCVE

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Adobe	Commerce Magento Open Source

Configuration 1 [-]

OR	cpe:2.3:a:adobe:commerce::::::::
	cpe:2.3:a:adobe:commerce:2.3.7:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.2:::::::*
	cpe:2.3:a:adobe:commerce:2.4.2:p1::::::
	cpe:2.3:a:adobe:commerce:2.4.2:p2::::::
	cpe:2.3:a:adobe:commerce:2.4.3:::::::*

Configuration 2 [-]

OR	cpe:2.3:a:adobe:magento_open_source::::::::
	cpe:2.3:a:adobe:magento_open_source:2.3.7:p1::::::
	cpe:2.3:a:adobe:magento_open_source:2.4.2:::::::*
	cpe:2.3:a:adobe:magento_open_source:2.4.2:p1::::::
	cpe:2.3:a:adobe:magento_open_source:2.4.2:p2::::::
	cpe:2.3:a:adobe:magento_open_source:2.4.3:::::::*

No data.

References

Link	Providers
https://helpx.adobe.com/security/products/magento/apsb21-86.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: adobe

Published: 2021-10-15T14:21:43.419320Z

Updated: 2024-09-17T01:07:10.682Z

Reserved: 2021-08-23T00:00:00

Link: CVE-2021-39864

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-10-15T15:15:08.460

Modified: 2024-11-21T06:20:25.057

Link: CVE-2021-39864

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Magento Commerce", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2.4.3", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThanOrEqual": "2.4.2-p2", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThanOrEqual": "2.3.7-p1", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThanOrEqual": "None", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2021-10-12T00:00:00", "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "Cross-Site Request Forgery (CSRF) (CWE-352)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-15T14:21:43", "orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://helpx.adobe.com/security/products/magento/apsb21-86.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@adobe.com", "DATE_PUBLIC": "2021-10-12T23:00:00.000Z", "ID": "CVE-2021-39864", "STATE": "PUBLIC", "TITLE": "Adobe Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Cart Addition"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Magento Commerce", "version": {"version_data": [{"version_affected": "<=", "version_value": "2.4.3"}, {"version_affected": "<=", "version_value": "2.4.2-p2"}, {"version_affected": "<=", "version_value": "2.3.7-p1"}, {"version_affected": "<=", "version_value": "None"}]}}]}, "vendor_name": "Adobe"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation."}]}, "impact": {"cvss": {"attackComplexity": "Low", "attackVector": "Network", "availabilityImpact": "None", "baseScore": 6.5, "baseSeverity": "Medium", "confidentialityImpact": "None", "integrityImpact": "High", "privilegesRequired": "None", "scope": "Unchanged", "userInteraction": "Required", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Cross-Site Request Forgery (CSRF) (CWE-352)"}]}]}, "references": {"reference_data": [{"name": "https://helpx.adobe.com/security/products/magento/apsb21-86.html", "refsource": "MISC", "url": "https://helpx.adobe.com/security/products/magento/apsb21-86.html"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:20:33.679Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://helpx.adobe.com/security/products/magento/apsb21-86.html"}]}]}, "cveMetadata": {"assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "assignerShortName": "adobe", "cveId": "CVE-2021-39864", "datePublished": "2021-10-15T14:21:43.419320Z", "dateReserved": "2021-08-23T00:00:00", "dateUpdated": "2024-09-17T01:07:10.682Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "D7005F6E-E43D-4EA5-A6E8-24A0820E6877", "versionEndIncluding": "2.3.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*", "matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "26B82CF0-829C-4CC4-B5FD-BD783B0C13BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:p1:*:*:*:*:*:*", "matchCriteriaId": "496DE1BC-DC23-4873-9A13-E166A267CC13", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.2:p2:*:*:*:*:*:*", "matchCriteriaId": "95AA877E-D67C-42B0-8673-EB7C1CFCE138", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:commerce:2.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "9BB93DC1-7F58-435F-A54D-3E0C9C6AD811", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*", "matchCriteriaId": "A5327705-B4FC-4774-8387-E4F164196A7A", "versionEndIncluding": "2.3.7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:magento_open_source:2.3.7:p1:*:*:*:*:*:*", "matchCriteriaId": "A9083101-E776-41CA-9DC9-455AFEC577F7", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "585335C3-60B7-48AA-98AF-CF144EB9C66D", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*", "matchCriteriaId": "8F768F94-34F1-4FB8-8D96-3BBC9D6B8C89", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.2:p2:*:*:*:*:*:*", "matchCriteriaId": "2B0BD7FD-BEC5-4953-B4E2-15AC65A11BA0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "5DFABFE3-ECCA-4CE5-87D9-E6895A32329F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation."}, {"lang": "es", "value": "Adobe Commerce versiones 2.4.2-p2 (y anteriores), 2.4.3 (y anteriores) y 2.3.7p1 (y anteriores), est\u00e1n afectadas por una vulnerabilidad de tipo cross-site request forgery (CSRF) por medio de un Enlace para Compartir la Lista de Deseos. Una explotaci\u00f3n con \u00e9xito podr\u00eda conllevar a una adici\u00f3n no autorizada al carrito del cliente por parte de un atacante no autenticado. No es requerido un acceso a la consola de administraci\u00f3n para una explotaci\u00f3n con \u00e9xito"}], "id": "CVE-2021-39864", "lastModified": "2024-11-21T06:20:25.057", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "psirt@adobe.com", "type": "Secondary"}]}, "published": "2021-10-15T15:15:08.460", "references": [{"source": "psirt@adobe.com", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb21-86.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Release Notes", "Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/magento/apsb21-86.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "psirt@adobe.com", "type": "Secondary"}]}