Return to Question

The new Magento Security Scanner reports that there are vulnerabilities on the website and that patch SUPEE 6482 is required. This occurs even when there are no Modules enabled.

However, we are currently running 1.9.3.7 and the same fixes from SUPEE 6482 were applied in 1.9.2.1. There is no download available for SUPEE 6482 for any version of Magento after 1.9.2.0.

Also confusing is that the specific vulnerability, called APPSEC-1030, only affected the Enterprise Edition of Magento prior to 1.14.2.1.

The SUPEE 6482 patch for 1.8.1.0 - 1.9.2.0 modifies the following files:

app/code/core/Mage/Api/Model/Server/Adapter/Soap.php app/code/core/Mage/Catalog/Model/Product/Api/V2.php

I have verified that these changes are already present, so applying the old SUPEE 6482 patch would do nothing. Additionally, none of these changes appear to address the APPSEC-1030 issue.

I am reasonably sure that this vulnerability - as it originally appeared in Magento - does not exist, but I am concerned that something else is re-introducing the same issue.

How do I determine exactly why this security check is failing?

The new Magento Security Scanner reports that there are vulnerabilities on the website and that patch SUPEE 6482 is required. This occurs even when there are no Modules enabled.

However, we are currently running 1.9.3.7 and the same fixes from SUPEE 6482 were applied in 1.9.2.1. There is no download available for SUPEE 6482 for any version of Magento after 1.9.2.0.

Also confusing is that the specific vulnerability, called APPSEC-1030, only affected the Enterprise Edition of Magento prior to 1.14.2.1.

The SUPEE 6482 patch for 1.8.1.0 - 1.9.2.0 modifies the following files:

app/code/core/Mage/Api/Model/Server/Adapter/Soap.php app/code/core/Mage/Catalog/Model/Product/Api/V2.php

I have verified that these changes are already present, so applying the old SUPEE 6482 patch would do nothing. Additionally, none of these changes appear to address the APPSEC-1030 issue.

I am reasonably sure that this vulnerability - as it originally appeared in Magento - does not exist, but I am concerned that something else is re-introducing the same issue.

How do I determine exactly why this security check is failing?

The new Magento Security Scanner reports that there are vulnerabilities on the website and that patch SUPEE 6482 is required. This occurs even when there are no Modules enabled.

However, we are currently running 1.9.3.7 and the same fixes from SUPEE 6482 were applied in 1.9.2.1. There is no download available for SUPEE 6482 for any version of Magento after 1.9.2.0.

Also confusing is that the specific vulnerability, called APPSEC-1030, only affected the Enterprise Edition of Magento prior to 1.14.2.1.

The SUPEE 6482 patch for 1.8.1.0 - 1.9.2.0 modifies the following files:

app/code/core/Mage/Api/Model/Server/Adapter/Soap.php app/code/core/Mage/Catalog/Model/Product/Api/V2.php

I have verified that these changes are already present, so applying the old SUPEE 6482 patch would do nothing. Additionally, none of these changes appear to address the APPSEC-1030 issue.

I am reasonably sure that this vulnerability - as it originally appeared in Magento - does not exist, but I am concerned that something else is re-introducing the same issue.

How do I determine exactly why this security check is failing?

The new Magento Security Scanner reports that there are vulnerabilities on the website and that patch SUPEE 6482 is required. This occurs even when there are no Modules enabled.

However, we are currently running 1.9.3.7 and the same fixes from SUPEE 6482 were applied in 1.9.2.1. There is no download available for SUPEE 6482 for any version of Magento after 1.9.2.0.

Also confusing is that the specific vulnerability, called APPSEC-1030, only affected the Enterprise Edition of Magento prior to 1.14.2.1.

The SUPEE 6482 patch for 1.8.1.0 - 1.9.2.0 modifies the following files:

app/code/core/Mage/Api/Model/Server/Adapter/Soap.php app/code/core/Mage/Catalog/Model/Product/Api/V2.php

I have verified that these changes are already present, so applying the old SUPEE 6482 patch would do nothing. Additionally, none of these changes appear to address the APPSEC-1030 issue.

I am reasonably sure that this vulnerability - as it originally appeared in Magento - does not exist, but I am concerned that something else is re-introducing the same issue.

How do I determine exactly why this security check is failing?