GHSA-r3c9-9j5q-pwv4

magento-lts Reset Password not protected against well-timed CSRF

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-21395

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	openmage/magento-lts	< 19.4.22	19.4.22
Packagist	openmage/magento-lts	>= 20.0.0, < 20.0.19	20.0.19

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Password reset form is vulnerable to CSRF between time reset password link is clicked and user submits new password. ### Patches PR forthcoming ### Workarounds None

References

External links from the advisory. They lead to third-party sites.

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-r3c9-9j5q-pwv4 web
https://nvd.nist.gov/vuln/detail/CVE-2021-21395 advisory
https://hackerone.com/reports/1086752 web
https://github.com/OpenMage/magento-lts package
https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22 web
https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19 web
https://packagist.org/packages/openmage/magento-lts web