Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
1
vote
0answers
83 views
+100

Magento 1.9 - Security Issue - Bug Shooting return Data has been tampered error in Success page?

Using Bug Shooting if i try to place an order i am getting response regard Data has been tampered. How to solve this issue?
0
votes
0answers
52 views

Is SUPEE-11295 missing fixes?

Adobe's Security Bulletin APSB20-02 mentions 6 security issues. I've read through the changes in SUPEE-11295 and I don't think that all of these issues are getting addressed. To my understanding, the ...
0
votes
0answers
44 views

magento 2 how to secure Cookie mage-cache-sessid and enable Secured Flag

Here Am trying to enable HttpOnly and Secured Flag for Cookies mage-cache-sessid or my domain. I did configuration in admin Panel >> store >> configuration >> general >> web but still flags not ...
0
votes
0answers
11 views

Magento EE 1.14 security patch Hunk #1 FAILED at 68

I am trying to apply patches to Magento EE 1.14 version but i am facing following issue checking file app/design/frontend/rwd/default/template/customer/form/changepassword.phtml Hunk #1 FAILED at 43....
2
votes
0answers
140 views

How upcoming SameSite cookie changes could affect Magento or 3rd modules, possible issues?

On February, 4, Google is set to roll out a new Chrome update that promises a bunch of new features designed to make the browser faster and more secure — including a new approach to cookies. The ...
0
votes
0answers
28 views

Magento 2 How to secure my checkout success page?

So I have create completely custom checkout page and after successfull order Im receiving via my ajax call a "Increment Id" from backend. With this increment Id I'm redirecting user to /checkout/...
-1
votes
2answers
31 views

Need magento 1.9.3.3 to apply patch

I want to know list of patches for my website which is in 1.9.3.3 version of magento please suggest.
1
vote
0answers
18 views

Unknown index “UsernamePasswordFormAuthenticve_index” in cron logfile - security issue?

Today i noticed a really strange index and code dump in cron.log: UsernamePasswordFormAuthenticve_index is successfully finished ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@...
0
votes
0answers
27 views

Which files under Magento webroot should be executable?

Security best practices suggest that you should never have an executable in a public web directory. However, in a typical Magento install (in my very limited experience), this is not true. Even in ...
0
votes
1answer
44 views

Need help to stop malicious code in index.php file

Need help to stop malicious code in index.php file Please help me if anyone have faced this same issue. I am using Magento ver. 1.9.4.3 index.php : * @category Mage */ $swvJgN7="xQC+...
0
votes
0answers
36 views

Transparent Data Encryption in Magento 2.3 Database

I need to encrypt customer data (company name, contact person, emai, address, etc.) within the magento mysql database. I'd like to realize this without introducing encryption/decryption in every ...
0
votes
0answers
25 views

Authentication type for API to be used by third party partners | Magento 2

We are creating an API in M2 enterprise edition to sell our giftcodes to a partner. The partner will have functionalities like: To have Store Credit Can buy giftcodes View buy history We cannot ...
0
votes
1answer
162 views

failed applying security patch SUPEE-11155 - Hunk #1 FAILED

patching file app/Mage.php Hunk #1 FAILED at 813. 1 out of 1 hunk FAILED -- saving rejects to file app/Mage.php.rej Can anyone point me in the right direction as to why I've a bunch of messages that ...
0
votes
0answers
57 views

Security patch 11219 risk error for Magento 1.9.2.4

Security patch 11219 risk Error for Magento 1.9.2.4 I'm using Magento 1.9.2.4 version in the Security patch error(magereport.com) But in the Magento Security patch not have this version (https://...
3
votes
1answer
57 views

Shell script dumps Model source code

Weird things happening. I've written a customized product import script which is executed as a shell script. In this script, I gather some XML input, parse it into an array and then try to import the ...
9
votes
11answers
6k views

SUPEE-11219 Potential issues?

Magento just sent out an email about a new security patch (SUPEE-11219). https://magento.com/security/patches/supee-11219 Affected versions: Magento Commerce 1.9.0.0-1.14.4.1 Magento Open Source 1....
0
votes
1answer
62 views

Magento 2: Spam Customer Accounts Created Automatically

I am using Magento 2.2.4 for my e-commerce website. From last few days, customer accounts creating automatically on my website without the proper information. I already installed Mageplaza Security ...
0
votes
1answer
45 views

Any other way to increase the customer logged in time in Magento-1.9 without increasing server session time session.gc_maxlifetime?

Any other way to increase the customer logged in time without increasing server session time? If we give a value as 78,00,000 seconds (3 months) for session.gc_maxlifetime in the php.ini file, then ...
1
vote
1answer
17 views

No (full) administrator access on backend Magento 2

After couple of weeks holiday i came back and stared in to an problem. I don't have access to the backend of Magento 2. My colleges have access and can do their work (product, inventory and ...
1
vote
0answers
50 views

Blank admin login page with Security titled empty field set

We have a working Magento 2.2.9 installation in production. Everything was fine and working and no one touched the code or the settings for weeks now. Today we suddenly could not log in to admin panel ...
0
votes
0answers
67 views

Magento security report We were unable to check for API ACL

I scanned my site from the Magento Security . The report showed We were unable to check for API ACL (APPSEC-1679) Magento version 2.3.2 How to solve this?
1
vote
1answer
86 views

/shell/log.php?region=%31… getting called

Cannot find anything in the internet about that. Here is whats comming in: 'REQUEST_METHOD' => 'POST', 'REQUEST_URI' => '/shell/log.php?region=%31&kunyuk=%31&MageShell=%31&xcv=%31&...
0
votes
1answer
48 views

How to secure our Magento store from hackers?

I have read somewhere that hackers are making target to e-commerce sites to hack. As we know Magento provides some inbuilt security features but still wants to know more regarding security. Also, ...
0
votes
0answers
108 views

Magento 2.2.2 Security Patch Issue

I have download PRODSECBUG-2233 from magento official site patch -p1 < PRODSECBUG-2233-2.2.x-2019-07-26-08-35-48.patch When i try to use this command, it's not working and show me this errors. ...
0
votes
1answer
24 views

*Why save magento visitor happen only when POST/PUT request?

I was involved in development of some service integration with magento. I provided this service callback URL. In controller/action I am creating a customer and making it logged in. But then I noticed ...
0
votes
1answer
30 views

How I can add security patch for magento 2.2.6 without updating magento

I have Magento 2.2.6 I want to update security patch I have lost my server databases (maybe SQL injection) my questions 1)How to update security patches? 2)Is it will helpful? 3)Is ...
0
votes
1answer
39 views

Magento 2 : How can I stop SQL attack through search bar

It's a bot that is continuously attacking, I try to hide these special characters suggestion form dashboard also try to delete them but all in vain, it comes again the next day(Magneto 2.3.1).
0
votes
3answers
276 views

Magento 2, Magento Unprotected XML

I have a Magneto 2.2.3 instance and when we check for security scan it is showing below error: We have determined that your Magento installation's configuration file(s) are publicly accessible ...
0
votes
2answers
273 views

Magento 2, XSS Patch not detected (APPSEC-2143)

In Magento security scan I got the below message for my Magento instance: XS Vulnerability - Failed. XSS Patch not detected (APPSEC-2143) I am using Magento 2.2.3 How could I resolve this? Is ...
0
votes
0answers
32 views

Magento 2 factor authentication

Can any one help in making magento 2 2fa (two factor authentication) extension which was released with magento 2.3 and make it compatible with magento 2.2.8 or 2.2.9. This is the extension release ...
2
votes
1answer
41 views

How to secure Magento 2.x guest API

I realized that it is possible to register customers through API without authentication. https://devdocs.magento.com/guides/v2.2/rest/anonymous-api-security.html Just make a POST call to https://...
1
vote
0answers
42 views

How secure is the Magento 2 File Uploader

I recently added my own form to the Magento frontend. The form contains a file type input, an used the file uploader class to save the file. But I was wondering how save this class is? I already ...
0
votes
0answers
20 views

Hideit input on other forms

I stumbled across hideit input on contact us form https://magento.stackexchange.com/a/107656/70343 Makes sense to catch bots filling out the form. Just wondering whether it's worth adding to other ...
2
votes
2answers
51 views

How to securely run PHP scripts in Magento 2

I know that we can run php scripts by placing our script in root of magento 2 folder and we can load products, orders etc via object manager and perform our desired functionality. although this method ...
2
votes
2answers
78 views

Magento cloud hosted M2 EE site compromised and got malware attack

Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url: <script src="http://write-cdn.com/...
0
votes
2answers
188 views

Magento 2 remove version number impact

I noticed if we type /magento_version along with site url then it displays our magento version. So anyone with bad intention can check my version and exploit it. to prevent this I can disable the ...
3
votes
0answers
19 views

Magento2 Security: How to best filter GET parameters before they reach Magento?

I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; ...
1
vote
0answers
33 views

Magento 2: Is there any site which is showing missing security patch?

Is there any website which is provide a report about missing security patch or which need to install ? I just need to install patch in magento 2.1.9.
0
votes
2answers
105 views

Magento 2 security scan failed AngularJS and XS Vulnerability

Our Magento 2 site failed the AngularJS and XS Vulnerability checks. Does anyone know how this can be fixed.
2
votes
0answers
24 views

Magento 1.9 - 503 Error timing out - Notice: iconv_strlen(): Detected an illegal character in input string

PHP 5.5.38 Magento 1.9.3.2 I've had a site running perfectly fine for over a year, and suddenly today its been timing out most of the time trying to load a page, with the 503 error page coming up ...
3
votes
1answer
39 views

Magento 2: Load patches or update

I'm aware that this probably isn't the first time this question has been answered, but I'm wondering what is the best approach to keeping my magento 2.3.1 install secure: Should I update to 2.3.2 or ...
28
votes
21answers
10k views

Security Patch SUPEE-11155 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What common issues do you have to watch out for when applying this patch/upgrade? Magento 1 https://magento.com/security/...
2
votes
4answers
182 views

Magento 2.3 secure your site back and front

Got a very security conscious client. I've searched stack exchange and only found partial solutions to certain security issues. I've also searched dev docs and again found one or two suggestions in ...
0
votes
1answer
157 views

Is it better to use Vue.js storefront as a frontend for magento 2?

We have to lunch a new store and planning to use Vue.js storefront on frontend. -> Will it be feasible easily - data will be interchanged using APIs -> Would there be any security issues ? -> Any ...
3
votes
1answer
198 views

Magento 2 Set Previous Password History

I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last ...
0
votes
0answers
22 views

Issues on blocking magento website

Is there any way where a magento website is enabled and opens even if teh internal IT firewall blocks it. Also no one blocked my website in the office. Still i am not able to open it in the office ...
2
votes
3answers
163 views

magento 1 malicious code attack in app/Mage.php

I have been working on a project and recently i am observing some malicious code is being added to the file app/Mage.php at the top of file. I have tried removing this code multiple times but it again ...
2
votes
2answers
259 views

Document root change help

I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache. I did the ...
3
votes
0answers
51 views

Magento 2 admin backend security

In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
1
vote
1answer
28 views

Magento 2 recommended approach to applying patches

So far had to apply patches through command line. Bugs me there is not version control for this as in some cases changing vendor folder contents which is ignored. More for accountability with time and ...

1 2 3 4 5 13