2

The new Magento Security Scanner reports that there are vulnerabilities on the website and that patch SUPEE 6482 is required. This occurs even when there are no Modules enabled.

Magento Security Scanner Result

However, we are currently running 1.9.3.7 and the same fixes from SUPEE 6482 were applied in 1.9.2.1. There is no download available for SUPEE 6482 for any version of Magento after 1.9.2.0.

Also confusing is that the specific vulnerability, called APPSEC-1030, only affected the Enterprise Edition of Magento prior to 1.14.2.1.

The SUPEE 6482 patch for 1.8.1.0 - 1.9.2.0 modifies the following files:

app/code/core/Mage/Api/Model/Server/Adapter/Soap.php app/code/core/Mage/Catalog/Model/Product/Api/V2.php

I have verified that these changes are already present, so applying the old SUPEE 6482 patch would do nothing. Additionally, none of these changes appear to address the APPSEC-1030 issue.

I am reasonably sure that this vulnerability - as it originally appeared in Magento - does not exist, but I am concerned that something else is re-introducing the same issue.

How do I determine exactly why this security check is failing?

Improve this question

2 Answers 2

Reset to default
1

Join the club.

I have the same failed security scan and like yourself I checked the files and all is as it should be with the SOAP adapter updates.

My test failed on Enterprise, patched to the latest and greatest. I did actually have a fail on SUPEE-8788 too, however, once I removed the .swf uploader files all was fixed - that patch had worked but left some binaries around for the admin flash uploader.

I am satisfied for now that I have the patches patched, however, in SUPEE-6482 you may want to see if there is anything going on with extra files left around. The scan code is a black box, who knows what it does and whether this error is with us or them.

Improve this answer
1
  • 1
    Github knows, the code for the security scanner is on Github somewhere. I don't have a link handy, but a black box it isn't.
    – toon81
    Commented Nov 30, 2017 at 12:42
1

If you use PHP opcode caches (APC/XCache/eAccelerator) make sure to flush it (or restart webserver) after patching, otherwise code will continue to run from caches.

Sometimes you need to upload the patched files yourself, depending on your server configuration. Running the patch script with the wrong user can result in problem.

I would suggest looking at the link below:

https://magentary.com/kb/install-supee-6482-without-ssh/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.