Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension

There's been no patch released by the actual vendor - Magestore

Does anyone know:

  1. What the vulnerability is?
  2. How to patch it?

I've created a github repo that holds the original code of this extension, so you can see what the code is and perhaps see what the vulnerability is and suggest a patch?

The scope of functionality and code are available on the public github repo.


Magestore released a patch, it can be found here https://blog.magestore.com/store-locator-extension-patch/

According to them

Please note that customers using Magento 1 are not affected by this issue.

closed as off-topic by Manashvi Birla, Jai, Mohit Kumar Arora, Aasim Goriya, Dhiren Vasoya Mar 13 at 10:43

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about third-party modules are generally off-topic because the scope of functionality and code are not available. For more information, see this meta post/answer." – Manashvi Birla, Jai, Mohit Kumar Arora, Aasim Goriya, Dhiren Vasoya
If this question can be reworded to fit the rules in the help center, please edit the question.

  • This is not off topic as Magento released an announcement about this also the code is available in the linked git-hub repo – Yehuda Schwartz Mar 13 at 13:39
  • I will just put this here but there is a patch from Magestore blog.magestore.com/store-locator-extension-patch – Klettseb Mar 13 at 22:45
  • Thanks. This patch is only for magento2. According to magestore this vulnerability does not affect M1 – Haim Mar 14 at 2:04

Interestingly enough we've run the security scan on our Magento2 development site which doesn't have the module installed, yet it flags it up. What is the security scan actually testing?

  • I recommend you report your issue to securityinfo@magento.com. In your report please specify the affected store URL. – Steven Zurek Mar 13 at 15:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.