Medium severity · published Jan 27, 2023
CVE-2021-21395
Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Magento · Openmage
before 19.4.22; 20.0.0 before 20.0.19 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21395
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21395
Third Party Advisory
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-r3c9-9j5q-pwv4
Exploit
https://hackerone.com/reports/1086752
Third Party Advisory
https://packagist.org/packages/openmage/magento-lts
More from Magento
9.8
CVE-2021-21426
Magento-lts is a long-term support alternative to Magento Community Edition (CE)
8.8
CVE-2026-40488
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
8.8
CVE-2021-41144
OpenMage LTS is an e-commerce platform
8.1
CVE-2026-25524
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
7.5
CVE-2023-41879
Magento LTS is the official OpenMage LTS codebase