Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension

There's been no patch released by the actual vendor - Magestore

Does anyone know:

  1. What the vulnerability is?
  2. How to patch it?

I've created a github repo that holds the original code of this extension, so you can see what the code is and perhaps see what the vulnerability is and suggest a patch?

The scope of functionality and code are available on the public github repo.


Magestore released a patch, it can be found here https://blog.magestore.com/store-locator-extension-patch/

According to them

Please note that customers using Magento 1 are not affected by this issue.

  • This is not off topic as Magento released an announcement about this also the code is available in the linked git-hub repo – Yehuda Schwartz Mar 13 '19 at 13:39
  • I will just put this here but there is a patch from Magestore blog.magestore.com/store-locator-extension-patch – Klettseb Mar 13 '19 at 22:45
  • Thanks. This patch is only for magento2. According to magestore this vulnerability does not affect M1 – Haim Mar 14 '19 at 2:04

Interestingly enough we've run the security scan on our Magento2 development site which doesn't have the module installed, yet it flags it up. What is the security scan actually testing?

| improve this answer | |
  • I recommend you report your issue to securityinfo@magento.com. In your report please specify the affected store URL. – Steven Zurek Mar 13 '19 at 15:12

Not the answer you're looking for? Browse other questions tagged or ask your own question.