1

I scanned the Magento 2 site from the official magento scanner and here's the result.

enter image description here

Any ideas on how and what specific patch to apply for this one?

Thanks!

2
  • What is your Magento version Jun 3, 2019 at 5:52
  • @MazeStricks: Able to install the1378 path and other issues related to patch in magento scan report? Dec 26, 2023 at 10:45

2 Answers 2

0

If you go here https://magento.com/security/patches/magento-2.0.16-and-2.1.9-security-update it instructs you on what to do. It looks like this link is in the report. Are the instructions not correct?

2
  • Yeah, I already did look into that link. But I can't find where exactly the right file patch to download. Or does it suggest to upgrade the My current Magento 2 installation to the one described on that link. Just correct me if I'm wrong. Thanks Jun 3, 2019 at 1:24
  • Yep 2.0.x upgrade to 2.0.16 or if 2.1.x upgrade to 2.1.9. What version are you running? Do you know? Jun 3, 2019 at 17:01
0

No separate patches has been released for this issue. You have to upgrade your Magento version to either 2.0.16 or 2.1.9 accordingly. Please find the available security patches for Magento 2 in this link https://www.magentocommerce.com/products/downloads/magento/. You will find an section Magento Open Source Patches - 2.x where the available patches are there.

So please upgrade your Magento version to either the latest release version or 2.0.16 or 2.1.9 to get this issue fixed.

5
  • Hello Raj, Thanks for the effort. But the Magento 2 version that the site is running is Magento 2.2, please advise thanks. Jun 3, 2019 at 6:12
  • So you are in Magento 2.2.0 right Jun 3, 2019 at 6:13
  • Yes! the store is running under that version Magento 2.2.0 Jun 3, 2019 at 6:14
  • As you are in Magento 2.2.0 you should not be getting API ACL and Information Leakage issues. These are than patches you are version might be missing and do apply these patches PRODSECBUG-2432, PRODSECBUG-2198 and try yet again Jun 3, 2019 at 6:28
  • Hello Yes, I'm very sure that it is running under Magento 2.2.0 and it's pretty weird because of the staging website does not show that Information Leakage scan results while it is present on the live website. Anyway thanks for your comments. Jun 3, 2019 at 6:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.