0

If I enable Admin routing compatibility mode for extensions Magento states that security of the admin would be weaken.

http://prntscr.com/8z9rqx

Please could someone explain exactly how it would be weaken? I have an instance where I have 20+ extensions which need this enabled to trying to figure out exactly what the security risks are

Improve this question

1 Answer 1

Reset to default
2

The compatibility mode is related to APPSEC-1034, addressing bypassing custom admin URL

From the SUPEE-6788 patch detail page:

Admin Path Disclosure - APPSEC-1034

CVSSv3 Severity: 5.3 (Medium)

Attacker can force showing admin panel login page regardless of admin panel URL by calling a module directly. It makes it easier to try automated password attacks and exposes admin URL on the page.

The best way is to update the extensions and disable compatibility mode:

1.) All reliable extension vendors updated their extensions so you just have to look for the latest releases.

2.) Update your own extensions with the information from the technical details page

See also here:

Improve this answer
1
  • Thanks for your reply, exactly what I wanted to know. My question after reading that is if I have other protection against automated attacks eg Recaptcha (prntscr.com/9ossms) does it really matter if I have this enabled
    – Goose84
    Commented Jan 11, 2016 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.