The Magento Security Scan returned this vulnerability:

API ACL - Failed.
API ACL Patch not detected (APPSEC-1679)
Apply the Magento 2.0.14/2.1.7 Security Update immediately.

However, my site is running Magento 2.3.3 (released Oct 2019). The patch mentioned is dated May 31, 2017 and is for a much older version.

APPSEC-1679: APIs vulnerable to CSRF
Product(s) Affected: Magento CE and EE prior to 2.0.14/2.1.7
Fixed In: Magento CE and EE 2.0.14/2.1.7

Are other people seeing this error (false positive) with Magento 2.3.3 and the Magento Security Scan tool?

Is there anything else I should know about this particular reported issue with my site?

  • Do you require 2FA for all admin users?
    – Hunter
    Dec 4 '19 at 15:47
  • @Hunter - we are working on that as well as OAuth-based authentication.
    – BugBuddy
    Dec 5 '19 at 5:16
  • Try making 2FA mandatory for every admin account and trying again after
    – Hunter
    Dec 10 '19 at 20:59

From Magento support I got the following answer,

Please make sure that Configuration->Services->Magento Web API->Web API Security->Allow Anonymous Guest Access is set to "Off". It is probably turned on. Thank you!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.