0

We've recently tested our website on Magento's own security scan tool and we were advised to install/patch the following:

  • API ACL - Failed.API ACL Patch not detected (APPSEC-1378) XS
  • Vulnerability - Failed.XSS Patch not detected (APPSEC-2143)

Now from my understanding, we would need to upgrade our entire Magento installation to have this patched which is technically not what we want to do.

Are there ways to have these 2 patches applied manually? This was always quite straight-forward with Magento 1.9.x but this seems more complex on Magento2.

PS: We're running on a highly customized Magento ver. 2.2.5 installation

Some expert advice would be greatly appreciated, thank you

Improve this question

1 Answer 1

Reset to default
-1

Please check Configuration.

Configuration -> Services -> Web API Security

Allow Anonymous Guest Access Should be "NO".

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.