The Magento Security Scan returned this vulnerability:

API ACL - Failed.
API ACL Patch not detected (APPSEC-1679)
Apply the Magento 2.0.14/2.1.7 Security Update immediately.

However, my site is running Magento 2.3.3 (released Oct 2019). The patch mentioned is dated May 31, 2017 and is for a much older version.

APPSEC-1679: APIs vulnerable to CSRF
Product(s) Affected: Magento CE and EE prior to 2.0.14/2.1.7
Fixed In: Magento CE and EE 2.0.14/2.1.7

Are other people seeing this error (false positive) with Magento 2.3.3 and the Magento Security Scan tool?

Is there anything else I should know about this particular reported issue with my site?

New contributor
BugBuddy is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • Do you require 2FA for all admin users? – Hunter Dec 4 at 15:47
  • @Hunter - we are working on that as well as OAuth-based authentication. – BugBuddy 2 days ago

Your Answer

BugBuddy is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.