CVE-2021-21395 Magneto-lts vulnerable to Cross-Site Request Forgery

What is CVE-2021-21395?

CVE-2021-21395 is a medium-severity vulnerability in OpenMage magento-lts, published on 27 Jan 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.

Weakness: CWE-352

Which versions are affected by CVE-2021-21395?

4 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.

Products include Openmage Magento.

How do I fix CVE-2021-21395?

Upgrade openmage/magento-lts to a fixed version for your release line: 19.4.22 or 20.0.19.

Is CVE-2021-21395 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-21395 exists.

Other vulnerabilities in OpenMage magento-lts

• CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper Critical 9.8
• CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2 Critical 9.1
• CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update High 8.8
• CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution High 8.7
• CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r3c9-9j5q-pwv4.