Cross-Site Request Forgery (CSRF)

openmage/magento-lts is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the resetPasswordPostAction function in AccountController.php because the user sessions are not properly managed which allows an attacker to change a user passwords...