Questions tagged [security]
Denotes security questions on Magento.
0
votes
0answers
43 views
SUPEE-10975: Impact
SUPEE-10975 seems to have some regressions and bugs that need to be fixed.
I expect a v2 of the patch to be released.
Questions:
How dangerous are the security issues fixed by SUPEE-10975?
Are ...
1
vote
0answers
34 views
Webgility Security Vulnerability Update
Webgility provides a module/extension for our Magento customers that enables communication with our core product, Unify. A security vulnerability was discovered in this module on October 16th, 2018 ...
3
votes
0answers
310 views
Security Patch SUPEE-10975 - Possible issues? [duplicate]
Magento has released a new security patch for M1, and updates for M1 and M2.
What issues should I look out for when upgrading or applying this patch?
SUPEE-10975
SUPEE-10975, Magento Commerce 1....
1
vote
2answers
123 views
Magento compromised, second “PayPal Express Checkout” option added sending payment to unauthorized recipient
I had an order come in that wasn't followed by a PayPal payment, so I asked the customer if he had paid, and he sent me a screenshot of the receipt which shows the payment going to "Trust Website ...
1
vote
1answer
62 views
Problem with patch SUPEE-10888 on Magento 1.9.0.1
Problem with patch PATCH_SUPEE-10888_CE_v1.9.0.1_v1-2018-09-19-03-00-53.sh on Magento 1.9.0.1, with all previous patches installed:
Checking if patch can be applied/reverted successfully...
ERROR: ...
1
vote
0answers
22 views
New security threat to Magento caused by it using jQuery-File-Upload?
Magento 2 uses the Blueimp jQuery File Upload Plugin v5.16.4 which has recently been identified at posing a security risk to web applications which use it.
Is this an issue for Magento and should ...
10
votes
11answers
2k views
SUPEE-10975 Potential Issues
SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support?
So far these ...
0
votes
0answers
15 views
Why does /soap not follow site X-FRAME header?
After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/...
0
votes
0answers
110 views
issues after CE upgrade from 1.9.3.2 to 1.9.3.10
I've upgraded Mangento CE 1.9.3.2 to 1.9.3.10 as a security update.
After this (which went smoothly) in
/var/www/magento/app/Mage.php
ive got this:
public static function getVersionInfo()
...
3
votes
2answers
346 views
Webgility RCE vulnerability
MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility.
While their tool is very helpful in scanning the site and asserting ...
1
vote
1answer
62 views
How to remove malicious code from the each files of the website magento 2?
I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website?
Is any script to remove or replace this malicious code?
...
1
vote
2answers
37 views
Magento 1.9.3.2 - Exception printing is disabled by default for security reasons
I have just moved a Magento install from one server to another and now when I try to access the frontend I get the "Exception printing is disabled by default for security reasons" error.
I have ...
2
votes
1answer
41 views
How to stop fake reviews and fake signups on Magento 1 and Magento 2?
We have 2 websites one is on Magento 1 and the second is on Magento 2 , In both websites we get fake reviews and fake signups everyday. Someone told me to add captcha which will not let bots or ...
0
votes
2answers
43 views
I found some malicious code in all index.php of magento 1.9.2
Need help to stop malicious code in all index.php file
Once I remove malicious code from index.php then again its apperar in index.php files
malicious code like --
$swvJgN7="xQC+...
1
vote
2answers
67 views
Our Magento account was hacked; files deleted; hosting company is unable to restore
Magento 1.9.1
Porto theme
Managed VPS from Hostforweb
CentOS 7.x/WHM / Cpanel
We got hacked. Files were deleted and our site was and is down. I have a full cPanel backup which I made available to our ...
1
vote
1answer
35 views
Magento2 Two factor authentication for Frontend
Do you guys know where to purchase or download M2 2FA ext for FRONTEND (or both frontend and admin)
0
votes
0answers
32 views
How to secure my website magento 2
I want to secure my website from script injection and other Security failures so is there patch or somthing that i have to do or upload to do so.
Also i want advice from you concerning sécurity ...
2
votes
1answer
27 views
How to create a nonce / secure hash in Magento 2?
I want a simple link to activate a customer out of an email that gets sent to the admin on registration.
I am using this module: https://github.com/enrico69/magento2-customer-activation for the ...
3
votes
2answers
40 views
Can anyone have any idea of security patch file of SUPEE-9652 V2?
As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
1
vote
0answers
20 views
Access orders page with wget [duplicate]
people. My question may be simple but I can't find an answer. I want to be able to get the page source of my orders with a command. I plan something like
wget -user myUserName -password myPassword ...
2
votes
0answers
51 views
Magento Security Scan reports Malicious Javascript without files
I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan.
For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
0
votes
0answers
232 views
Magento known issue while upgrade from 1.9.3.9 to 1.9.3.10? [duplicate]
I just got notification that 1.9.3.10 is released with SUPEE-10888 curious to know if someone has already update it and faced any issue?
17
votes
16answers
4k views
Security Patch SUPEE-10888 - Possible issues?
SUPEE-10888 is a new security patch for Magento 1 which addresses 12 security issues.
https://magento.com/security/patches/supee-10888
SUPEE-10888, Magento Commerce 1.14.3.10 and Open Source 1.9.3....
1
vote
0answers
37 views
Magento 2 CE + CyberSource Checkout [closed]
I'm trying to set up a 2.2.5 store with CyberSource v3, however, I keep receiving below error.
You are not authorized to view this page. The transaction has not been
processed. If the problem ...
1
vote
1answer
38 views
Magento 1.9 with no security patches got hacked. How to install the security patches without Magento Connect?
Magento 1.9.1
Porto theme
Our Magento got hacked. The hacker deleted our user accounts and created one for themselves with the user ID of shopmanager1. I had to connect to the database, delete his ...
0
votes
0answers
29 views
How to delegate Magento 1=>2 migration to a 3rd party, without leaking PII?
My company manages many Magento stores for our clients. Most things we do in-house, but migrating 100+ stores to 2.x on our own would take a lot of manhours, so we'd like to test some 3rd party ...
0
votes
1answer
60 views
The site ahead contains malware Attackers currently on magento
My Website is not working from 3 days boheco.org(magento version- 1.9.3.4)
3
votes
2answers
138 views
Malware Attack On Magento 1.9.2
My website www.antiqworld.com whenever i am trying to open my website automatically redirect on (https://20.unverf.com/?h=230916016_ee5d07ec7ec_98__def_sub__sub_id_2&cnv=1) this url
please help ...
1
vote
1answer
253 views
Using SVG logo in Magento 2.2.4
I am trying to upload an SVG logo for my Magento website, but it is not allowing me to upload an SVG file. It says that it is an unsupported file. Any idea how to resolve this?
Based on internet ...
0
votes
0answers
106 views
Magento 2 - Security : HTTP Only cookie
Our Security team raised security issue cookie setting and asked to set HTTP only and Secure cookie. Looks like Magento functionality overrides HTTP only parameter. To fix this issue we have set ...
0
votes
0answers
18 views
Magento attack redirection to admin login page
Analyzing my website logs I saw a lot of POST requests to:
{domain}/index.php/installtemplate/adminhtml_installtemplate/index
and
{domain}/index.php/installtemplate/adminhtml_installtemplate/...
0
votes
1answer
76 views
Data Security has been compromised
In my Magento 1.9 store, some of the Customer's Default Billing name and Address
has been amended. I first got to know this when one of my customer complained to me about their name that has been ...
1
vote
0answers
49 views
I have Chinese chars in the contents of my session files. Have I been hacked?
I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
2
votes
0answers
63 views
Is Magento 2 REST API CSRF-proof?
As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
1
vote
1answer
84 views
Magento 2 : What's the best practice when it comes to escaping in templates?
This is a question about best practices when it comes to writing templates / block classes and security.
When it comes to writing templates I know you need to escape everything that comes into the ...
0
votes
1answer
71 views
What is the data encryption / hashing key management method used in Magento 2
Like in the title.
What is the data encryption / hashing key management method used in Magento 2?
I found this question Encryption Method Used by Magento Enterprise, however, is the same method used ...
0
votes
0answers
27 views
Magento 1.9.1 error while security patches SUPEE-3941
When I am trying to install any patches it will give me error like below,
ERROR: Patch can't be applied/reverted successfully.
patching file downloader/Maged/Model/Connect.php
Hunk #1 FAILED at 486.
...
0
votes
0answers
14 views
How to restrict magento rest API,it is only accessible by https?
I want to access API with HTTPS only.If anyone access my API with HTTP,it does not work.How can achieve it?
1
vote
2answers
386 views
Hunk error applying PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to Magento 1.9.2
Getting some errors applying the PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to my Magento 1.9.2
Checking if patch can be applied/reverted successfully...
ERROR: Patch can't be applied/reverted ...
0
votes
0answers
17 views
Mganto1.9 : Item (Mage_Sales_Model_Order) with same id already exist
After I migrate my Magento shop from one hosting provider to another one I have a big problem. When I want to go in back to administration into sales->order I get an error
There has been an ...
1
vote
2answers
96 views
Magento 1.9.2.1 how to prevent core_config_data from getting malicious scripts
I have been scanning the website at Magento Scan and getting the following error:
Magento Compromise Injection
Your site is compromised with injected JavaScript. (131)
The malicious code ...
14
votes
14answers
6k views
Security Patch SUPEE-10752 - Possible issues?
A new security patch is out for Magento 1, addressing 25 APPSEC issues
https://magento.com/security/patches/supee-10752
What common issues do you have to watch out for when applying this patch?
...
0
votes
0answers
26 views
Why is customer/section/* accessible publicly? Can we hide this?
I am relatively new to Magento 2. I have created a store and ran security scan and noticed I have the following:
URL: https://www.mystore.com/customer/section/load/install/ or https://www.mystore.com/...
2
votes
1answer
824 views
Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:
I don't know what it's means and how to remove this error.
it's showing in my chrome console . but not in firefox console..
(index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
1
vote
1answer
25 views
How do I enable https for my site in Magento 1.9.3.7?
Where would I go in the Admin Panel of Magento 1.9.3.7 to change my site to be https and secure?
Thank you.
0
votes
3answers
542 views
Magento 2 Newsletter fake subscriptions
Easily with any email you can subscribe to Magento 2 newsletter.
The only available control is to send confirmation email to provided address.
If provided email address is not valid Magento ...
0
votes
1answer
103 views
Hide Magento Admin Url from outside world
We have a magento server up and running. The server had the default 'admin' url which was then changed to some random string for security purpose, which only our team knows. Now we also have an admin ...
1
vote
1answer
80 views
Magento 1.3 .ru bots attack! [duplicate]
I'm being attacked by .ru bots on my Magento 1.3.
Is there any plugin that works for this old version? Or a way to block them?
0
votes
1answer
36 views
Magento 1.7: PCI scan Can't Pass category URL with 'mode' param
Don't know why but the PCI scan do not pass Category URL of Magento and provide a SQL injection with 'mode' param in the below format.
/main-category/sub-category/l/price:10-20/category-name.html?dir=...
0
votes
1answer
817 views
Magento 1 end of life on Nov. 2018 or not?
Please see this answer by an internal staff of Magento who states that:
Magento 1.x end of life is November 2018.
However on their official blog, this post states:
Magento 1 has been and will ...
