« Volver al listado

CVE-2021-39864

Estado: ModificadaMedia (6.5)—

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Adobe — CommerceAdobe — Magento Open Source

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-39864",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-39864",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-23T13:10:33.563442Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@adobe.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "Adobe",
          "product": "Magento Commerce",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.4.3"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.4.2-p2"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "2.3.7-p1"
            },
            {
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom",
              "lessThanOrEqual": "None"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-10-15T15:15:08.460",
  "references": [
    {
      "url": "https://helpx.adobe.com/security/products/magento/apsb21-86.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "https://helpx.adobe.com/security/products/magento/apsb21-86.html",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@adobe.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation."
    },
    {
      "lang": "es",
      "value": "Adobe Commerce versiones 2.4.2-p2 (y anteriores), 2.4.3 (y anteriores) y 2.3.7p1 (y anteriores), están afectadas por una vulnerabilidad de tipo cross-site request forgery (CSRF) por medio de un Enlace para Compartir la Lista de Deseos. Una explotación con éxito podría conllevar a una adición no autorizada al carrito del cliente por parte de un atacante no autenticado. No es requerido un acceso a la consola de administración para una explotación con éxito"
    }
  ],
  "lastModified": "2026-06-17T04:04:19.353",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:commerce:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D7005F6E-E43D-4EA5-A6E8-24A0820E6877",
              "versionEndIncluding": "2.3.7"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:2.3.7:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F471E19-8AFE-4A6C-88EA-DF94428518F7"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:2.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "26B82CF0-829C-4CC4-B5FD-BD783B0C13BB"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:2.4.2:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "496DE1BC-DC23-4873-9A13-E166A267CC13"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:2.4.2:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95AA877E-D67C-42B0-8673-EB7C1CFCE138"
            },
            {
              "criteria": "cpe:2.3:a:adobe:commerce:2.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BB93DC1-7F58-435F-A54D-3E0C9C6AD811"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5327705-B4FC-4774-8387-E4F164196A7A",
              "versionEndIncluding": "2.3.7"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento_open_source:2.3.7:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9083101-E776-41CA-9DC9-455AFEC577F7"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "585335C3-60B7-48AA-98AF-CF144EB9C66D"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F768F94-34F1-4FB8-8D96-3BBC9D6B8C89"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.2:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B0BD7FD-BEC5-4953-B4E2-15AC65A11BA0"
            },
            {
              "criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5DFABFE3-ECCA-4CE5-87D9-E6895A32329F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}