Description
A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to be added to a shopper's cart due to an insufficiently robust anti-CSRF token implementation.
Remediation
References
Related Vulnerabilities
Jenkins Improper Input Validation Vulnerability (CVE-2012-6073)
WordPress Plugin Admin side data storage for Contact Form 7 Cross-Site Scripting (1.1.1)
PHP Numeric Errors Vulnerability (CVE-2009-5016)
WordPress Plugin Bold Page Builder Security Bypass (2.3.1)
Internet Information Services Other Vulnerability (CVE-2001-0709)