Magneto-lts vulnerable to Cross-Site Request Forgery

Vulnerability

The password reset form in OpenMage Magento LTS (Long Term Support), a community-maintained fork of Magento CE, is vulnerable to Cross-Site Request Forgery (CSRF) [1][2]. The vulnerability exists in the window between the time a user clicks a password reset link and submits a new password. Versions prior to 19.4.22 and 20.0.19 are affected [1][2].

Exploitation

An attacker can exploit this by tricking an authenticated user who has requested a password reset into submitting a crafted request. The CSRF arises because the reset form lacks a unique token tied to the user's session between the initial link click and the final submission [3]. No authentication is needed for the CSRF attack itself; the user must have an active password reset session.

Impact

Successful exploitation could allow an attacker to change the victim's account password without their consent, potentially leading to account takeover [2][3]. This compromises the confidentiality and integrity of user accounts.

Mitigation

Patches are available in OpenMage LTS versions 19.4.22 and 20.0.19 [1][2]. There are no workarounds; upgrading to a patched version is required. The OpenMage project encourages migration from official Magento CE for ongoing security support [4].