CVE-2021-21027

MEDIUM

Magento < 2.3.6 - Unauthenticated Cross-Site Request Forgery via GraphQL API

Title source: llm
STIX 2.1

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

References (1)

Core 1
Core References

Scores

CVSS v3 4.3
EPSS 0.0037
EPSS Percentile 58.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Details

CWE
CWE-352
Status published
Products (6)
magento/community-edition 0 - 2.3.6-p1Packagist
magento/magento 2.3.6 (2 CPE variants)
magento/magento 2.4.0 (4 CPE variants)
magento/magento 2.4.1 (2 CPE variants)
magento/magento < 2.3.6 (2 CPE variants)
magento/project-community-edition 0Packagist
Published Feb 11, 2021
Tracked Since Feb 18, 2026