CVE-2021-39864

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

Score

CVSS 3.1 6.5 Medium

Status

Modified - psirt@adobe.com

Published

2021-10-15

Last modified

2025-04-23

Weaknesses

CWE-352

Affected products

• Commerce (Adobe)
• Magento Commerce (Adobe)
• Magento Open Source (Adobe)

References

• https://helpx.adobe.com/security/products/magento/apsb21-86.html