Read the docs
TI-2021-04494 Aliases CVE-2021-21395GHSA-r3c9-9j5q-pwv4

Magneto-lts vulnerable to Cross-Site Request Forgery

Priority MEDIUM 53CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

Magneto LTS (Long Term Support) is a community developed alternative to the Magento CE official releases. Versions prior to 19.4.22 and 20.0.19 are vulnerable to Cross-Site Request Forgery. The password reset form is vulnerable to CSRF between the time the reset password link is clicked and user submits new password. This issue is patched in versions 19.4.22 and 20.0.19. There are no workarounds.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00394 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed magento-lts (OpenMage): 19.4.22, 20.0.19openmage/magento-lts (Packagist): 19.4.22, 20.0.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenMagemagento-ltsbefore 19.4.22; 20.0.0 to before 20.0.1919.4.22, 20.0.19Patch availableCNA
—openmage/magento-lts (Packagist)before 19.4.2219.4.22Patch availableGHSA-r3c9-9j5q-pwv4
—openmage/magento-lts (Packagist)20.0.0 to before 20.0.1920.0.19Patch availableGHSA-r3c9-9j5q-pwv4
  • magento-lts VendorOpenMage Affected before 19.4.22; 20.0.0 to before 20.0.19 Fixed in 19.4.22, 20.0.19 Patch available CNA
  • openmage/magento-lts (Packagist) Vendor— Affected before 19.4.22 Fixed in 19.4.22 Patch available GHSA-r3c9-9j5q-pwv4
  • openmage/magento-lts (Packagist) Vendor— Affected 20.0.0 to before 20.0.19 Fixed in 20.0.19 Patch available GHSA-r3c9-9j5q-pwv4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*before 19.4.22; 20.0.0 to before 20.0.19VulnerableOpenMage
  • cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:* Versions before 19.4.22; 20.0.0 to before 20.0.19 Vulnerable ·OpenMage

Remediation

  • Fix · CNA magento-lts (OpenMage) Fixed in 19.4.22, 20.0.19
  • Fix · GHSA-r3c9-9j5q-pwv4 openmage/magento-lts (Packagist) Fixed in 19.4.22 Advisory →
  • Fix · GHSA-r3c9-9j5q-pwv4 openmage/magento-lts (Packagist) Fixed in 20.0.19 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21395
  2. 2026-10-03 Alias added: GHSA-r3c9-9j5q-pwv4

References

Exploit 1

Advisory 3

Other 3

  • TI-2026-20633 OpenMage LTS's Phar Deserialization leads to Remote Code Execution CVSS 3.1HIGH 8.1
  • TI-2026-29239 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-22272 Magento LTS's guest order "protect code" can be brute-forced too easily CVSS 3.1HIGH 7.5
  • TI-2026-28925 Missing authorization in OpenMage magento-lts CVSS 4.0MEDIUM 5.3
  • TI-2026-20634 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module CVSS 3.1MEDIUM 4.9
  • TI-2025-39617 OpenMage is vulnerable to XSS in Admin Notifications CVSS 4.0MEDIUM 4.6
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences