We've recently tested our website on Magento's own security scan tool and we were advised to install/patch the following:
- API ACL - Failed.API ACL Patch not detected (APPSEC-1378) XS
- Vulnerability - Failed.XSS Patch not detected (APPSEC-2143)
Now from my understanding, we would need to upgrade our entire Magento installation to have this patched which is technically not what we want to do.
Are there ways to have these 2 patches applied manually? This was always quite straight-forward with Magento 1.9.x but this seems more complex on Magento2.
PS: We're running on a highly customized Magento ver. 2.2.5 installation
Some expert advice would be greatly appreciated, thank you