Questions tagged [security]
Denotes security questions on Magento.
591
questions
0
votes
0answers
13 views
Blank admin login page with Security titled empty field set
We have a working Magento 2.2.9 installation in production. Everything was fine and working and no one touched the code or the settings for weeks now. Today we suddenly could not log in to admin panel ...
0
votes
0answers
33 views
Magento security report We were unable to check for API ACL
I scanned my site from the Magento Security . The report showed
We were unable to check for API ACL (APPSEC-1679)
Magento version 2.3.2
How to solve this?
0
votes
1answer
67 views
/shell/log.php?region=%31… getting called
Cannot find anything in the internet about that.
Here is whats comming in:
'REQUEST_METHOD' => 'POST',
'REQUEST_URI' => '/shell/log.php?region=%31&kunyuk=%31&MageShell=%31&xcv=%31&...
0
votes
1answer
37 views
How to secure our Magento store from hackers?
I have read somewhere that hackers are making target to e-commerce sites to hack. As we know Magento provides some inbuilt security features but still wants to know more regarding security. Also, ...
0
votes
0answers
21 views
Magento 2.2.2 Security Patch Issue
I have download PRODSECBUG-2233 from magento official site
patch -p1 < PRODSECBUG-2233-2.2.x-2019-07-26-08-35-48.patch
When i try to use this command, it's not working and show me this errors.
...
0
votes
0answers
13 views
*Why save magento visitor happen only when POST/PUT request?
I was involved in development of some service integration with magento. I provided this service callback URL. In controller/action I am creating a customer and making it logged in. But then I noticed ...
0
votes
1answer
14 views
How I can add security patch for magento 2.2.6 without updating magento
I have Magento 2.2.6
I want to update security patch
I have lost my server databases (maybe SQL injection)
my questions
1)How to update security patches?
2)Is it will helpful?
3)Is ...
0
votes
1answer
21 views
Magento 2 : How can I stop SQL attack through search bar
It's a bot that is continuously attacking, I try to hide these special characters suggestion form dashboard also try to delete them but all in vain, it comes again the next day(Magneto 2.3.1).
0
votes
2answers
95 views
Magento 2, Magento Unprotected XML
I have a Magneto 2.2.3 instance and when we check for security scan it is showing below error:
We have determined that your Magento installation's configuration
file(s) are publicly accessible ...
0
votes
2answers
81 views
Magento 2, XSS Patch not detected (APPSEC-2143)
In Magento security scan I got the below message for my Magento instance:
XS Vulnerability - Failed.
XSS Patch not detected (APPSEC-2143)
I am using Magento 2.2.3
How could I resolve this?
Is ...
0
votes
0answers
26 views
Magento 2 factor authentication
Can any one help in making magento 2 2fa (two factor authentication) extension which was released with magento 2.3 and make it compatible with magento 2.2.8 or 2.2.9.
This is the extension release ...
2
votes
1answer
24 views
How to secure Magento 2.x guest API
I realized that it is possible to register customers through API without authentication.
https://devdocs.magento.com/guides/v2.2/rest/anonymous-api-security.html
Just make a POST call to https://...
1
vote
1answer
33 views
How secure is the Magento 2 File Uploader
I recently added my own form to the Magento frontend. The form contains a file type input, an used the file uploader class to save the file. But I was wondering how save this class is?
I already ...
0
votes
0answers
16 views
Hideit input on other forms
I stumbled across hideit input on contact us form
https://magento.stackexchange.com/a/107656/70343
Makes sense to catch bots filling out the form. Just wondering whether it's worth adding to other ...
2
votes
2answers
40 views
How to securely run PHP scripts in Magento 2
I know that we can run php scripts by placing our script in root of magento 2 folder and we can load products, orders etc via object manager and perform our desired functionality. although this method ...
2
votes
2answers
45 views
Magento cloud hosted M2 EE site compromised and got malware attack
Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url:
<script src="http://write-cdn.com/...
0
votes
2answers
43 views
Magento 2 remove version number impact
I noticed if we type /magento_version along with site url then it displays our magento version. So anyone with bad intention can check my version and exploit it.
to prevent this I can disable the ...
3
votes
0answers
17 views
Magento2 Security: How to best filter GET parameters before they reach Magento?
I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; ...
0
votes
0answers
25 views
Magento 2: Is there any site which is showing missing security patch?
Is there any website which is provide a report about missing security patch or which need to install ?
I just need to install patch in magento 2.1.9.
0
votes
2answers
68 views
Magento 2 security scan failed AngularJS and XS Vulnerability
Our Magento 2 site failed the AngularJS and XS Vulnerability checks. Does anyone know how this can be fixed.
1
vote
0answers
19 views
Magento 1.9 - 503 Error timing out - Notice: iconv_strlen(): Detected an illegal character in input string
PHP 5.5.38
Magento 1.9.3.2
I've had a site running perfectly fine for over a year, and suddenly today its been timing out most of the time trying to load a page, with the 503 error page coming up ...
3
votes
1answer
37 views
Magento 2: Load patches or update
I'm aware that this probably isn't the first time this question has been answered, but I'm wondering what is the best approach to keeping my magento 2.3.1 install secure: Should I update to 2.3.2 or ...
28
votes
18answers
6k views
Security Patch SUPEE-11155 - Possible issues?
Magento has released a new security patch for M1, and updates for M1 and M2.
What common issues do you have to watch out for when applying this patch/upgrade?
Magento 1
https://magento.com/security/...
1
vote
4answers
72 views
Magento 2.3 secure your site back and front
Got a very security conscious client.
I've searched stack exchange and only found partial solutions to certain security issues.
I've also searched dev docs and again found one or two suggestions in ...
0
votes
1answer
63 views
Is it better to use Vue.js storefront as a frontend for magento 2?
We have to lunch a new store and planning to use Vue.js storefront on frontend.
-> Will it be feasible easily - data will be interchanged using APIs
-> Would there be any security issues ?
-> Any ...
0
votes
1answer
71 views
Magento 2 Set Previous Password History
I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last ...
0
votes
0answers
13 views
Issues on blocking magento website
Is there any way where a magento website is enabled and opens even if teh internal IT firewall blocks it.
Also no one blocked my website in the office. Still i am not able to open it in the office ...
1
vote
3answers
107 views
magento 1 malicious code attack in app/Mage.php
I have been working on a project and recently i am observing some malicious code is being added to the file app/Mage.php at the top of file. I have tried removing this code multiple times but it again ...
1
vote
2answers
75 views
Document root change help
I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache.
I did the ...
1
vote
0answers
22 views
Magento 2 admin backend security
In addition to the extension settings, extension installation loads a lot of unnecessary content.
if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
0
votes
1answer
25 views
Magento 2 recommended approach to applying patches
So far had to apply patches through command line. Bugs me there is not version control for this as in some cases changing vendor folder contents which is ignored. More for accountability with time and ...
3
votes
1answer
88 views
Magento 2 create ajax request from out of magento
I wanna create Ajax request from empty HTML with jQuery.
I do like this
$.ajax({
url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****",
type: "POST",
...
3
votes
1answer
22 views
Magento Phishing Attempt
I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt.
...
1
vote
2answers
82 views
Why admin added to the site?
Today automatically added two admins to my site?
Is my site hacked?
What should I do to fix this bug?
0
votes
0answers
23 views
Do I need to update to 2.3.1?
If I have a store set up on 2.3 and I'm having issues getting it to update to 2.3.1 , what are the cons of not updating?
2
votes
1answer
41 views
What does Magento 1's end of life mean for security?
With Magento 1 nearing it's end of life in June 2020, what are the biggest threats when it comes to security?
1
vote
0answers
103 views
Magento 2.3: How to configure magento CLI commands to use custom names for dangerous redis commands
Environment
OS: Ubuntu 18.04 LTS
Server: Apache 2.4
Database: MySQL v14.14 distribution 5.7.25
PHP: 7.2
Redis: 5.0.4
Issue
Following the digitalocean tutorial referenced ...
0
votes
1answer
93 views
Want to install SUPEE-11086 patch for magento 1.9.2.0 version
I want to install SUPEE-11086 patch Magento 1.9.2.0 version.
Does anyone have an idea about this?
0
votes
0answers
105 views
which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE
I know how to install a patch file. But which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE.
Does anyone know which is the patch I should apply for 1.14.2.0 EE?
0
votes
0answers
47 views
Security problem: newsletter/subscribe has not been whitelisted
i have just move the my magento store to new hosting then im facing this issue
In the system.log file im just getting this error , also follows this step but still not did not get any luck. still ...
0
votes
0answers
18 views
Magento1 website Security patch installation by script then error show
Magento1 website Security patch installation by script and
when run url in browser (like http://www.mywebsite.com/applypatch.php)then below error show:
ERROR: "/app/etc/" must exist for proper ...
0
votes
1answer
28 views
Magento1 website Security patch installation by script
Magento1 my website i have installing following Security patch:
Security patch 10975
Security patch 10415
Security patch 9767
Security patch 8788
Security patch 7405
but i want script in my root ...
4
votes
2answers
320 views
Carding attack on website
I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal.
This doesn't seem to be doing enough to stop the attacks.
Paypal threatens to shut off my account, ...
1
vote
0answers
122 views
I Have Install this (SUPEE 11086 ) Patch in Magento 1.9.0.4 but Data.php is not working?
I have Install SUPEE 11086 Patch install successfully but not work Properly in backed side?
Thanks.
1
vote
1answer
623 views
Magento1 SUPEE-11086 Potential Issues? [duplicate]
The Description of the patch SUPEE-11086 is:
SUPEE-11086, Magento Commerce 1.14.4.1 and Open Source 1.9.4.1 contain
multiple security enhancements that help close remote code execution
(RCE), ...
24
votes
17answers
5k views
Security Patch SUPEE-11086 - Possible issues?
Magento has released a new security patch for M1, and updates for M1 and M2.
These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible."
...
6
votes
1answer
209 views
Critical Vulnerability in Magestore Store Locator extension [closed]
Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension
There's been no patch released by the actual vendor - Magestore
Does anyone know:
What the ...
2
votes
0answers
139 views
How to implement content security policy in magento 2
I want to know how to implement CSP on Magento 2 with GTM.
The site has multiple stores. Tried to google but was unable to find any concrete result.
Implimenting a Content Security Policy Magento 1....
0
votes
1answer
142 views
how to prevent xss attacks and sql injection in magento 2 [closed]
I need to know if there are some configuration from Bo or some patch to prevent those type of attack.
0
votes
0answers
20 views
Security steps and permission to have for Magento2
I did penetration testing, I got some duplicate theme files in my pub/static/theme, On deleting them something wrong happened with my lib/web the entire folder got empty. Still dont know how this ...
