CVE-2021-39864

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Adobe Commerce versions 2.4.2-p2 (and earlier), 2.4.3 (and earlier) and 2.3.7p1 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via a Wishlist Share Link. Successful exploitation could lead to unauthorized addition to customer cart by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Oct 15, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-398653.3Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerabCVE-2021-398665.4A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens.CVE-2021-398678.1In all versions of GitLab CE/EE since version 8.15, a DNS rebinding vulnerability in Gitea Importer may be exploited by an attacker to triggCVE-2021-398684.3In all versions of GitLab CE/EE since version 8.12, an authenticated low-privileged malicious user may create a project with unlimited reposCVE-2021-398696.5In all versions of GitLab CE/EE since version 8.9, project exports may expose trigger tokens configured on that project.CVE-2021-39874.3An improper access control vulnerability exists in janeczku/calibre-web. The affected version allows users without public shelf permissions CVE-2021-398704.3In all versions of GitLab CE/EE since version 11.11, an instance that has the setting to disable Repo by URL import enabled is bypassed by aCVE-2021-398714.3In all versions of GitLab CE/EE since version 13.0, an instance that has the setting to disable Bitbucket Server import enabled is bypassed CVE-2021-398726.5In all versions of GitLab CE/EE since version 14.1, an improper access control vulnerability allows users with expired password to still accCVE-2021-398734.3In all versions of GitLab CE/EE, there exists a content spoofing vulnerability which may be leveraged by attackers to trick users into visitCVE-2021-398744.3In all versions of GitLab CE/EE since version 11.0, the requirement to enforce 2FA is not honored when using git commands.CVE-2021-398755.3In all versions of GitLab CE/EE since version 13.6, it is possible to see pending invitations of any public group or public project by visit
CVE-2021-39864: Medium severity, CVSS 6.5 | Vulnix