CVE-2019-7851 — Cross-Site Request Forgery in Magento

CWE-352 — Cross-Site Request Forgery5 documents4 sources
Severity
6.5MEDIUMNVD
OSV7.5
EPSS
0.0%
top 91.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
MagentoMagento Community-editionAdobe Systems Incorporated Magento 2
Timeline
PublishedAug 2
Latest updateNov 24

Description

A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unintended data deletion from customer pages.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶NVDmagento/magento2.1.0 — 2.1.18+2
▶Packagistmagento/community-edition2.1.0 — 2.1.18+2
▶CVEListV5adobe_systems_incorporated/magento_2Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2

🔴Vulnerability Details

4
OSV
runc-app, runc-stable regression↗2025-11-24
▶
OSV
Magento 2 Community Edition CSRF vulnerability↗2022-05-24
▶
GHSA
Magento 2 Community Edition CSRF vulnerability↗2022-05-24
▶
CVEList
CVE-2019-7851: A cross-site request forgery vulnerability in Magento 2↗2019-08-02
▶
CVE-2019-7851 — Cross-Site Request Forgery in Magento | cvebase