Questions tagged [security]
Denotes security questions on Magento.
1
vote
4answers
61 views
Magento 2.3 secure your site back and front
Got a very security conscious client.
I've searched stack exchange and only found partial solutions to certain security issues.
I've also searched dev docs and again found one or two suggestions in ...
0
votes
1answer
37 views
Is it better to use Vue.js storefront as a frontend for magento 2?
We have to lunch a new store and planning to use Vue.js storefront on frontend.
-> Will it be feasible easily - data will be interchanged using APIs
-> Would there be any security issues ?
-> Any ...
0
votes
1answer
30 views
Magento 2 Set Previous Password History
I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last ...
0
votes
0answers
11 views
Issues on blocking magento website
Is there any way where a magento website is enabled and opens even if teh internal IT firewall blocks it.
Also no one blocked my website in the office. Still i am not able to open it in the office ...
1
vote
3answers
77 views
magento 1 malicious code attack in app/Mage.php
I have been working on a project and recently i am observing some malicious code is being added to the file app/Mage.php at the top of file. I have tried removing this code multiple times but it again ...
0
votes
2answers
43 views
Document root change help
I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache.
I did the ...
0
votes
0answers
9 views
Magento 2 admin backend security
In addition to the extension settings, extension installation loads a lot of unnecessary content.
if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
0
votes
1answer
24 views
Magento 2 recommended approach to applying patches
So far had to apply patches through command line. Bugs me there is not version control for this as in some cases changing vendor folder contents which is ignored. More for accountability with time and ...
3
votes
1answer
58 views
Magento 2 create ajax request from out of magento
I wanna create Ajax request from empty HTML with jQuery.
I do like this
$.ajax({
url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****",
type: "POST",
...
3
votes
1answer
20 views
Magento Phishing Attempt
I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt.
...
1
vote
2answers
79 views
Why admin added to the site?
Today automatically added two admins to my site?
Is my site hacked?
What should I do to fix this bug?
0
votes
0answers
21 views
Do I need to update to 2.3.1?
If I have a store set up on 2.3 and I'm having issues getting it to update to 2.3.1 , what are the cons of not updating?
2
votes
1answer
37 views
What does Magento 1's end of life mean for security?
With Magento 1 nearing it's end of life in June 2020, what are the biggest threats when it comes to security?
1
vote
0answers
100 views
Magento 2.3: How to configure magento CLI commands to use custom names for dangerous redis commands
Environment
OS: Ubuntu 18.04 LTS
Server: Apache 2.4
Database: MySQL v14.14 distribution 5.7.25
PHP: 7.2
Redis: 5.0.4
Issue
Following the digitalocean tutorial referenced ...
0
votes
1answer
86 views
Want to install SUPEE-11086 patch for magento 1.9.2.0 version
I want to install SUPEE-11086 patch Magento 1.9.2.0 version.
Does anyone have an idea about this?
0
votes
1answer
86 views
which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE
I know how to install a patch file. But which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE.
Does anyone know which is the patch I should apply for 1.14.2.0 EE?
0
votes
0answers
37 views
Security problem: newsletter/subscribe has not been whitelisted
i have just move the my magento store to new hosting then im facing this issue
In the system.log file im just getting this error , also follows this step but still not did not get any luck. still ...
0
votes
0answers
18 views
Magento1 website Security patch installation by script then error show
Magento1 website Security patch installation by script and
when run url in browser (like http://www.mywebsite.com/applypatch.php)then below error show:
ERROR: "/app/etc/" must exist for proper ...
0
votes
1answer
26 views
Magento1 website Security patch installation by script
Magento1 my website i have installing following Security patch:
Security patch 10975
Security patch 10415
Security patch 9767
Security patch 8788
Security patch 7405
but i want script in my root ...
4
votes
2answers
244 views
Carding attack on website
I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal.
This doesn't seem to be doing enough to stop the attacks.
Paypal threatens to shut off my account, ...
1
vote
0answers
122 views
I Have Install this (SUPEE 11086 ) Patch in Magento 1.9.0.4 but Data.php is not working?
I have Install SUPEE 11086 Patch install successfully but not work Properly in backed side?
Thanks.
1
vote
1answer
557 views
Magento1 SUPEE-11086 Potential Issues? [duplicate]
The Description of the patch SUPEE-11086 is:
SUPEE-11086, Magento Commerce 1.14.4.1 and Open Source 1.9.4.1 contain
multiple security enhancements that help close remote code execution
(RCE), ...
23
votes
17answers
4k views
Security Patch SUPEE-11086 - Possible issues?
Magento has released a new security patch for M1, and updates for M1 and M2.
These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible."
...
6
votes
1answer
177 views
Critical Vulnerability in Magestore Store Locator extension [closed]
Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension
There's been no patch released by the actual vendor - Magestore
Does anyone know:
What the ...
1
vote
0answers
65 views
How to implement content security policy in magento 2
I want to know how to implement CSP on Magento 2 with GTM.
The site has multiple stores. Tried to google but was unable to find any concrete result.
Implimenting a Content Security Policy Magento 1....
0
votes
1answer
102 views
how to prevent xss attacks and sql injection in magento 2 [closed]
I need to know if there are some configuration from Bo or some patch to prevent those type of attack.
0
votes
0answers
18 views
Security steps and permission to have for Magento2
I did penetration testing, I got some duplicate theme files in my pub/static/theme, On deleting them something wrong happened with my lib/web the entire folder got empty. Still dont know how this ...
2
votes
1answer
30 views
Security Report - patch 8788
Patch 8788 is available for <= 1.9.2.4.
I have 1.9.3.4.
How can I fix the issues addressed?
4
votes
2answers
295 views
Database possibly compromised
I want to know if strangers have accessed the database.
If so, I want to find out how they got access to the database.
I found a strange trigger in the database (screenshot below).
1
vote
0answers
47 views
How to enable Two Factor Authentication for Customer Accounts
I would like to enable two-factor-authentication for Customer Accounts, but as per the documentation (https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html)...
1
vote
0answers
7 views
Creating custom 2FA provider
I'd like to enable the 2FA extension but I'd like to write my own provider (e.g. not Authy or Google Authenticator).
Anybody who can point me in the right direction? I have been working with ...
3
votes
1answer
103 views
Do bound parameters get escaped using the Core/Resource model?
Consider the following example:
$connection = Mage::getSingleton('core/resource')->getConnection('core_read');
$email_address = $_GET['email'];
$sql = 'SELECT * FROM `foo` WHERE `email_address` = ...
1
vote
1answer
106 views
Help! Credit Card Grabber Found on Magento 1.9
I've found a piece of code that contacts a really weird domain with CC info.
Can someone confirm it doing something malicious?
If so, what should I do without taking down the server? I'm a total ...
0
votes
0answers
20 views
Magento 2.2.2 - Restrict access to Admin and redirect to 404 if unautohrized
I need to allow specific IP's/IP range as authorized users to access Magento admin area and redirect to 404 page not found if an unauthorized IP try to access
http://store.com/admin. Could think of ...
2
votes
1answer
140 views
is this a spam email or real
Message ID : <201812262203.wBQM3RsD009630@web1.gohost.sk>
Sent Date : Wed, 26 Dec 2018 22:03:27 +0000
From : magento@gohost.sk
Sender MailID : magento@gohost.sk
Reply To : magento@gohost.sk
To : ...
0
votes
0answers
19 views
ASV scan failing because of Session ID in URL
We're on a Magento 1.9.3.7 and our Aperia ASV scan is failing because of Session ID in URL.
One example would be the following https://mystore.com/category.html?SID=rmdfi0m0gibepot9eom7egj384
Payload:...
0
votes
1answer
126 views
Magento 1 - Patch SUPEE-10415 is not applied
I have tried to apply path SUPEE-10415 to magento 1.9.1.0, but its won't succedeed.
Please find the report below.
Checking if patch can be applied/reverted successfully.
ERROR: Patch can't be ...
1
vote
1answer
29 views
Prevent Magento2 display information on script on homepage
I would like to know how can i stop magento2 to printing information about my plugin and script on homepage.If u analyze my code i have got all these script that contain information about all plugin i ...
0
votes
1answer
206 views
Webgility Security Vulnerability Update [closed]
Webgility provides a module/extension for our Magento customers that enables communication with our core product, Unify. A security vulnerability was discovered in this module on October 16th, 2018 ...
3
votes
0answers
464 views
Security Patch SUPEE-10975 - Possible issues? [duplicate]
Magento has released a new security patch for M1, and updates for M1 and M2.
What issues should I look out for when upgrading or applying this patch?
SUPEE-10975
SUPEE-10975, Magento Commerce 1....
1
vote
2answers
207 views
Magento compromised, second “PayPal Express Checkout” option added sending payment to unauthorized recipient
I had an order come in that wasn't followed by a PayPal payment, so I asked the customer if he had paid, and he sent me a screenshot of the receipt which shows the payment going to "Trust Website ...
2
votes
1answer
310 views
Problem with patch SUPEE-10888 on Magento 1.9.0.1
Problem with patch PATCH_SUPEE-10888_CE_v1.9.0.1_v1-2018-09-19-03-00-53.sh on Magento 1.9.0.1, with all previous patches installed:
Checking if patch can be applied/reverted successfully...
ERROR: ...
1
vote
0answers
36 views
New security threat to Magento caused by it using jQuery-File-Upload?
Magento 2 uses the Blueimp jQuery File Upload Plugin v5.16.4 which has recently been identified at posing a security risk to web applications which use it.
Is this an issue for Magento and should ...
15
votes
14answers
5k views
SUPEE-10975 Potential Issues
SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support?
So far these ...
0
votes
0answers
17 views
Why does /soap not follow site X-FRAME header?
After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/...
3
votes
2answers
989 views
Webgility RCE vulnerability
MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility.
While their tool is very helpful in scanning the site and asserting ...
1
vote
1answer
335 views
How to remove malicious code from the each files of the website magento 2?
I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website?
Is any script to remove or replace this malicious code?
...
1
vote
2answers
131 views
Magento 1.9.3.2 - Exception printing is disabled by default for security reasons
I have just moved a Magento install from one server to another and now when I try to access the frontend I get the "Exception printing is disabled by default for security reasons" error.
I have ...
2
votes
1answer
56 views
How to stop fake reviews and fake signups on Magento 1 and Magento 2?
We have 2 websites one is on Magento 1 and the second is on Magento 2 , In both websites we get fake reviews and fake signups everyday. Someone told me to add captcha which will not let bots or ...
1
vote
2answers
140 views
I found some malicious code in all index.php of magento 1.9.2
Need help to stop malicious code in all index.php file
Once I remove malicious code from index.php then again its apperar in index.php files
malicious code like --
$swvJgN7="xQC+...
