Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
0 votes
0 answers
28 views

Unrecognized REST API order created

We have noticed a new order created in the admin which has come from the REST API. (Order was automatically cancelled) We have nothing running that creates orders in this way and the IP country and ...
user avatar
  • 474
2 votes
1 answer
22 views

How to Configure Magento 2 Security Scan?

Can anyone please explain STEP-BY-STEP PROCESS TO CONFIGURE MAGENTO 2 SECURITY SCAN? Thanks
user avatar
1 vote
2 answers
135 views

Security update for Magento Open Source APSB22-12 Which version?

I need to run the new security patches on Magento Open Source 2.4.3 - 2.4.3-p1 but Adobe don't actually elaborate on how to choose the correct version. My guess would be the COMPOSER version, but I ...
user avatar
  • 172
0 votes
1 answer
140 views

Magento2.4.2 Too many password reset requests

About to migrate. I get this issue for Admins. I need to disable this so my team (18 people) can choose their own passwords. Can I disable this ? If only for an hour or so.
user avatar
0 votes
1 answer
37 views

Do Security updates require a compile?

I would like to apply the security hotfix for the recently found vulnerabilites: https://support.magento.com/hc/en-us/articles/4426353041293-Security-updates-available-for-Adobe-Commerce-APSB22-12- Is ...
user avatar
0 votes
0 answers
38 views

How to remove thousands of fake customer accounts?

I'm trying to remove all fake customer accounts, but first I need to unsubscribe them from my newsletter, I have around 600k fake accounts to remove, trying to run it via admin massive action I got ...
user avatar
0 votes
0 answers
27 views

sensitive URL available for anyone, help!

I'm facing an issue that specific URLS are available for everyone, these URLS contain sensitive file and should be displayed only for that specific customer. For example: John123 has an invoice that ...
user avatar
1 vote
1 answer
254 views

How to know if my ElasticSearch is vulnerable against Log4j?

I don't have Java installed in my main Docker, but I'm using ElasticSearch v6.8.3 in another instance. curl -XGET 'http://localhost:9200' Am I vulnerable against Log4j even not running ElasticSearch ...
user avatar
1 vote
2 answers
485 views

How to check Log4j in Magento installation?

I don't know if my Magento server is infected by Log4j, how could I check it?
user avatar
0 votes
0 answers
32 views

PayPal controller is hit using script in Magento 2?

We were targeted by a bot that validates credit cards and we noticed in logs that the POST queries had been made to hit the Paypal Controller below. /Paypal/transparent/requestSecureToken/ The ...
user avatar
0 votes
0 answers
42 views

Magento 2 disable X-Frame-Options and use CSP frame-ancestors instead

We need one of our website available in a iframe on a different domain. The problem is that X-Frame-Options blocks the request and you can not use the * or ALLOW-FROM uri anymore. Please see link for ...
user avatar
  • 1
1 vote
1 answer
355 views

Prevent Bot traffic with .htaccess on Magento 2?

How to prevent(block) bad bots traffic with .htaccess for Magento 2 ? What you recommend ? I do not know how to do this. And which codes in .htaccess I need to modify. Or Do we have any other ...
user avatar
1 vote
2 answers
93 views

Magento2 Apply Patches

I have some customers that use some "older" Magento 2 versions, like for example 2.3.4. I would like to keep the store updated with the latest security patches but without doing a full ...
user avatar
0 votes
1 answer
102 views

Unable to find 2FA tab under security tab in store configuration

I want to enable 2FA for admin login in Magento 2.4.2 but it is missing. Thanks
user avatar
0 votes
0 answers
78 views

JavaScript url being stripped out of html

I have a very odd issue happening that I have been struggling with and can't find answer to. We have a 3rd party module to add GTM to the site and after doing a deploy the GTM is fine. After a ...
user avatar
-1 votes
1 answer
792 views

How to disable Magento 2 Content Security Policy with theme edit only

I have searched alot on the internet and I want to hide this error (magento 2.4) content security policy error , we don't have authority to disable magento_csp module and we can not create module, we ...
user avatar
0 votes
1 answer
20 views

Make action available only for admin

I added a button to admin order view which sends request to an url of an action controller (using ajax), and now I need to somehow make it available only for admin. What is the best solution for this ...
user avatar
1 vote
1 answer
26 views

Security issue ? User with restricted scope can access ALL orders on a multiwebsite setup

Using Magento Cloud EE here but this issue might be the same on CE I'm not sure. Create user foo Create role test Assign foo to test Restrict website scope for test to www.website1.com only Login ...
user avatar
  • 128
1 vote
0 answers
32 views

Magento 2.2 - Mage-Report Exposed Magento 2 API

Magento 2.2.3 I have scan the website in Mage Report, How to solve Exposed Api issue. What magento2 patch for this instead to upgrade version.
user avatar
  • 1,288
0 votes
1 answer
108 views

Payment Failed Emails M 2.3.5 - Not working for us

We are currently using Magento 2.3.5 From my understanding, payment failed emails are sent when a transaction fails. By fails I hope that this means it is declined or voided by the payment method. ...
user avatar
  • 31
1 vote
0 answers
53 views

prevent brute force attacks on the discount codes

Is there a way to prevent brute force attacks on the discount code input eg limit the number of discount codes a customer can enter a day?
user avatar
  • 2,429
1 vote
1 answer
188 views

Script injection below body tag in Magento 2.4.1

I upgraded our Magento from 1.9 to 2.4.1 after we found malware that was trying copy customer credit cards before allowing the customer to use PayPal. I used Magento's migration tools to copy data to ...
user avatar
1 vote
0 answers
117 views

"Catalog Search index process unknown error:" 403 Forbidden

My System info: Apache2 /php7.4(mod-security, mod_proxy) /Mysql8 /Elastic7.10 After a fresh installation of M2.4 and configure it for the E7 with Apache proxy port 8080 to 9200. When I tried to run ...
user avatar
  • 13
1 vote
1 answer
119 views

Is the Magento 2 file system allowed to be owned by www-data? + Permissions question

I work at a company where I noticed that most of our Magento 2 file system is owned by www-data and in the www-data group on our Ubuntu server.Furthermore, the docroot directory /var/www/<...
user avatar
0 votes
1 answer
388 views

How to check Magento Cloud patches available?

My Magento 2.3 Cloud is not updated, and I see some issues that when I reporting to Magento they send me a patch already released. Is there a way to see the list of patches available?
user avatar
0 votes
1 answer
144 views

How to fix XSS in website in url ? Magento 1

I can see that browsing url like this https://www.anywebsite.com/?p=%3Cscript%3Ealert(document.cookie)%3C/script%3E shows alert into browser window. Is their any way to prevent it ? its XSS.
user avatar
0 votes
0 answers
22 views

Category/search images not showing in Firefox

I get Content Security Policy errors in Firefox. I have a CSP module that handles this just fine in Chrome, but this remains an issue in Firefox. Are there more steps that have to be taken to make ...
user avatar
0 votes
1 answer
64 views

Phishing Attack - Magento 1.9 - Too many Get method request for customer login page - Site Down

The IP : 167.172.230.190 hit my customer login page too many hits makes my server down Screenshot : https://snipboard.io/kde4fw.jpg Notes : Custom login page captcha enabled, added that IP in IP ...
user avatar
  • 95
2 votes
1 answer
1k views

Two-Factor Authentication Invalid in Magento 2 admin panel

My client enabled 2FA (Two-Factor Authentication) in the Magento 2 admin panel, but every time that I scan the code to have it configured in my Google Authenticator and try to enter the code, it's ...
user avatar
0 votes
1 answer
57 views

Basic Auth / Restricting backend admin panel for M1

Good evening. Should it not be possible toeither restrict or use basic auth on the admin panel for login? Just as an extra security layer. Can there be any flaws/errors regadring 3rd party extentions ...
user avatar
2 votes
1 answer
602 views

Magento 2 module to log failed login attempts, for Fail2ban

I want to log failed login attempts to the admin backend of Magento 2 to a simple text file, to later be consumed by Fail2ban easily. E.g. for every failed login attempt, the module would add a line ...
user avatar
10 votes
1 answer
2k views

Sanitizing HTML output in templates in 2.4

Before 2.4 the way you could sanitize an html value in a template was to use $block->escapeHtml($valueHere);. Where $blick is the instance of the current block. This still works in 2.4, but the ...
user avatar
  • 195k
0 votes
1 answer
126 views

Magento 2 and SELinux

So it turned out that SELinux is causing all the issues I've been having with USPS shipping calculation and Paypal redirecting. This is my current stack: 2.3.5p1 CentOS 8 PHP 7.3.18 Apache/2.4.37 ...
user avatar
  • 33
1 vote
0 answers
38 views

5 malicious files found in Magento with a malware scan - are they for real or false positive?

Magento 1.9.x Softaculous installer in Cpanel A malware scan on our server has detected the following 5 malicious files - are these really problematic or could these just be false positives? /home/...
user avatar
  • 306
0 votes
2 answers
285 views

Why is BitDefender flagging Magento 1 sites as containing malware

I'm not sure if this is the right place to ask this question, so apologies in advance. I've just noticed that several Magento 1 sites I look after including development sites are now being blocked by ...
user avatar
  • 53
0 votes
1 answer
77 views

Static content deploy generate thousands of weird folder names

i've run setup:static-content:deploy -f and now i'm getting a lot of strange folders on my pub/static/frontend folder For example one folder has the name "G7oLVFdw'; waitfor delay '0:0:6' -- " This ...
user avatar
19 votes
9 answers
26k views

Magento 2.3.5-p1 CSP font-src self unsafe-inline

In regarding to CSP I create own csp_whitelist, but still I am getting: The Content Security Policy 'font-src 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag....
user avatar
4 votes
4 answers
10k views

How can I fix "Refused to load the stylesheet because it violates the following Content" in Magento 2.3.5

I've recently upgraded to Magento 2.3.5 and I've been encountering an issue with my Content Security Policy when trying to load a style sheet. The error (Chrome dev console): I've added maxcdn to ...
user avatar
  • 731
4 votes
1 answer
11k views

Magento 2.3.5 Content Security Policy directive: "img-src

Upgrade to 2.3.5 and now getting this error bellow thought out the site on every page: [Report Only] Refused to load the image 'blob:http://my.domayn.com/axxxxxxxxxxxx' because it violates the ...
user avatar
8 votes
10 answers
5k views

Security Patch SUPEE-11314 - Possible problems?

Magento have released new Magento 1 versions 1.14.4.5 1.9.4.5 The patch number is SUPEE-11314 and is available at https://magento.com/tech-resources/download A summary (covering both M1 and M2 so ...
user avatar
  • 4,392
0 votes
0 answers
37 views

How to install magento patch on old version

I have a 2.3.1 magento and i want to install the last security patch from 2.3.5. Can your confirm me that i have to install a least the 2.3.4 magento version before ? I am confused beceause With ...
user avatar
0 votes
0 answers
575 views

Magento 2 Security Patches Tracking

I need to understand this new Magento 2 patches. So I see that security patches are released as 2.3.3-p1. Let's say my version is Magento 2.3.2. And Magento has released 2.3.2-p1, 2.3.3-p1, 2.3.4-p1,...
user avatar
2 votes
0 answers
556 views

Implementing Google reCaptcha v.2 with Gene_Braintree module

Magento version EE 2.3.3-p1. I was wondering if anyone out there has implemented core Msp_Recaptcha at checkout when using the BrainTree or Gene_BrainTree modules. We've been hit HARD by carding ...
user avatar
1 vote
1 answer
162 views

What's security-only patch release and how to apply it?

I noticed we have security-only patch releases, what's it and how to use it? An example of these security-only patch releases, instead of having Magento 2.3.2 my client has installed Magento 2.3.3-p1....
user avatar
0 votes
0 answers
133 views

Wrong URL for category image when root is set to pub directory

I want to use pub/ directory for security reasons as document root for Magento website but when i switch it, images for categories and for manufacturers (in product detail) are not displayed. I ...
user avatar
1 vote
1 answer
129 views

Magento 2 Outdated JS Libraries - Failed. Outdated AngularJS library found Issue

We are using magento ver 2.2.4 and after run magento security scan tool, In generated report we found following error:- Outdated JS Libraries - Failed.Outdated AngularJS library found, response ...
user avatar
  • 771
1 vote
1 answer
125 views

Profiler is enabled after a maintenance flag is created - malware?

It seems like the profiler on my site is automatically enabled after the site goes down in maintenance mode- Is there any reason why magento goes into maintenance mode and subsequently, the profiler ...
user avatar
0 votes
0 answers
283 views

Security Error - Bug Shooting return Data has been tampered error in Success page?

Magento 1.9 - Using Bug Shooting if i try to place an order i am getting response regard Data has been tampered. How to solve this security issue?
user avatar
  • 95
0 votes
0 answers
780 views

magento 2 how to secure Cookie mage-cache-sessid and enable Secured Flag

Here Am trying to enable HttpOnly and Secured Flag for Cookies mage-cache-sessid or my domain. I did configuration in admin Panel >> store >> configuration >> general >> web but still flags not ...
user avatar
2 votes
0 answers
906 views

How upcoming SameSite cookie changes could affect Magento or 3rd modules, possible issues?

On February, 4, Google is set to roll out a new Chrome update that promises a bunch of new features designed to make the browser faster and more secure — including a new approach to cookies. The ...
user avatar
  • 2,255

1
2 3 4 5
13