Magento Cross-Site Request Forgery (CSRF)

2022-05-1403:46:39

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.9%

JSON

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.

CPENameOperatorVersion
magento/community-editioneq0.1.0-alpha99
magento/community-editioneq0.74.0-beta9
magento/community-editioneq0.1.0-alpha107
magento/community-editioneq0.42.0-beta9
magento/community-editioneq0.74.0-beta14
magento/community-editioneq0.74.0-beta12
magento/community-editioneq0.1.0-alpha102
magento/community-editioneq0.1.0-alpha90
magento/community-editioneq0.42.0-beta3
magento/community-editioneq2.0.0-rc

Name	Operator	Version
magento/community-edition	eq	0.1.0-alpha99
magento/community-edition	eq	0.74.0-beta9
magento/community-edition	eq	0.1.0-alpha107
magento/community-edition	eq	0.42.0-beta9
magento/community-edition	eq	0.74.0-beta14
magento/community-edition	eq	0.74.0-beta12
magento/community-edition	eq	0.1.0-alpha102
magento/community-edition	eq	0.1.0-alpha90
magento/community-edition	eq	0.42.0-beta3
magento/community-edition	eq	2.0.0-rc