Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Denotes security questions on Magento.

0
votes
0answers
43 views

SUPEE-10975: Impact

SUPEE-10975 seems to have some regressions and bugs that need to be fixed. I expect a v2 of the patch to be released. Questions: How dangerous are the security issues fixed by SUPEE-10975? Are ...
1
vote
0answers
34 views

Webgility Security Vulnerability Update

Webgility provides a module/extension for our Magento customers that enables communication with our core product, Unify. A security vulnerability was discovered in this module on October 16th, 2018 ...
3
votes
0answers
310 views

Security Patch SUPEE-10975 - Possible issues? [duplicate]

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10975 SUPEE-10975, Magento Commerce 1....
1
vote
2answers
123 views

Magento compromised, second “PayPal Express Checkout” option added sending payment to unauthorized recipient

I had an order come in that wasn't followed by a PayPal payment, so I asked the customer if he had paid, and he sent me a screenshot of the receipt which shows the payment going to "Trust Website ...
1
vote
1answer
62 views

Problem with patch SUPEE-10888 on Magento 1.9.0.1

Problem with patch PATCH_SUPEE-10888_CE_v1.9.0.1_v1-2018-09-19-03-00-53.sh on Magento 1.9.0.1, with all previous patches installed: Checking if patch can be applied/reverted successfully... ERROR: ...
1
vote
0answers
22 views

New security threat to Magento caused by it using jQuery-File-Upload?

Magento 2 uses the Blueimp jQuery File Upload Plugin v5.16.4 which has recently been identified at posing a security risk to web applications which use it. Is this an issue for Magento and should ...
10
votes
11answers
2k views

SUPEE-10975 Potential Issues

SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support? So far these ...
0
votes
0answers
15 views

Why does /soap not follow site X-FRAME header?

After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/...
0
votes
0answers
110 views

issues after CE upgrade from 1.9.3.2 to 1.9.3.10

I've upgraded Mangento CE 1.9.3.2 to 1.9.3.10 as a security update. After this (which went smoothly) in /var/www/magento/app/Mage.php ive got this:     public static function getVersionInfo() ...
3
votes
2answers
346 views

Webgility RCE vulnerability

MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility. While their tool is very helpful in scanning the site and asserting ...
1
vote
1answer
62 views

How to remove malicious code from the each files of the website magento 2?

I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website? Is any script to remove or replace this malicious code? ...
1
vote
2answers
37 views

Magento 1.9.3.2 - Exception printing is disabled by default for security reasons

I have just moved a Magento install from one server to another and now when I try to access the frontend I get the "Exception printing is disabled by default for security reasons" error. I have ...
2
votes
1answer
41 views

How to stop fake reviews and fake signups on Magento 1 and Magento 2?

We have 2 websites one is on Magento 1 and the second is on Magento 2 , In both websites we get fake reviews and fake signups everyday. Someone told me to add captcha which will not let bots or ...
0
votes
2answers
43 views

I found some malicious code in all index.php of magento 1.9.2

Need help to stop malicious code in all index.php file Once I remove malicious code from index.php then again its apperar in index.php files malicious code like -- $swvJgN7="xQC+...
1
vote
2answers
67 views

Our Magento account was hacked; files deleted; hosting company is unable to restore

Magento 1.9.1 Porto theme Managed VPS from Hostforweb CentOS 7.x/WHM / Cpanel We got hacked. Files were deleted and our site was and is down. I have a full cPanel backup which I made available to our ...
1
vote
1answer
35 views

Magento2 Two factor authentication for Frontend

Do you guys know where to purchase or download M2 2FA ext for FRONTEND (or both frontend and admin)
0
votes
0answers
32 views

How to secure my website magento 2

I want to secure my website from script injection and other Security failures so is there patch or somthing that i have to do or upload to do so. Also i want advice from you concerning sécurity ...
2
votes
1answer
27 views

How to create a nonce / secure hash in Magento 2?

I want a simple link to activate a customer out of an email that gets sent to the admin on registration. I am using this module: https://github.com/enrico69/magento2-customer-activation for the ...
3
votes
2answers
40 views

Can anyone have any idea of security patch file of SUPEE-9652 V2?

As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
1
vote
0answers
20 views

Access orders page with wget [duplicate]

people. My question may be simple but I can't find an answer. I want to be able to get the page source of my orders with a command. I plan something like wget -user myUserName -password myPassword ...
2
votes
0answers
51 views

Magento Security Scan reports Malicious Javascript without files

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan. For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
0
votes
0answers
232 views

Magento known issue while upgrade from 1.9.3.9 to 1.9.3.10? [duplicate]

I just got notification that 1.9.3.10 is released with SUPEE-10888 curious to know if someone has already update it and faced any issue?
17
votes
16answers
4k views

Security Patch SUPEE-10888 - Possible issues?

SUPEE-10888 is a new security patch for Magento 1 which addresses 12 security issues. https://magento.com/security/patches/supee-10888 SUPEE-10888, Magento Commerce 1.14.3.10 and Open Source 1.9.3....
1
vote
0answers
37 views

Magento 2 CE + CyberSource Checkout [closed]

I'm trying to set up a 2.2.5 store with CyberSource v3, however, I keep receiving below error. You are not authorized to view this page. The transaction has not been processed. If the problem ...
1
vote
1answer
38 views

Magento 1.9 with no security patches got hacked. How to install the security patches without Magento Connect?

Magento 1.9.1 Porto theme Our Magento got hacked. The hacker deleted our user accounts and created one for themselves with the user ID of shopmanager1. I had to connect to the database, delete his ...
0
votes
0answers
29 views

How to delegate Magento 1=>2 migration to a 3rd party, without leaking PII?

My company manages many Magento stores for our clients. Most things we do in-house, but migrating 100+ stores to 2.x on our own would take a lot of manhours, so we'd like to test some 3rd party ...
0
votes
1answer
60 views

The site ahead contains malware Attackers currently on magento

My Website is not working from 3 days boheco.org(magento version- 1.9.3.4)
3
votes
2answers
138 views

Malware Attack On Magento 1.9.2

My website www.antiqworld.com whenever i am trying to open my website automatically redirect on (https://20.unverf.com/?h=230916016_ee5d07ec7ec_98__def_sub__sub_id_2&cnv=1) this url please help ...
1
vote
1answer
253 views

Using SVG logo in Magento 2.2.4

I am trying to upload an SVG logo for my Magento website, but it is not allowing me to upload an SVG file. It says that it is an unsupported file. Any idea how to resolve this? Based on internet ...
0
votes
0answers
106 views

Magento 2 - Security : HTTP Only cookie

Our Security team raised security issue cookie setting and asked to set HTTP only and Secure cookie. Looks like Magento functionality overrides HTTP only parameter. To fix this issue we have set ...
0
votes
0answers
18 views

Magento attack redirection to admin login page

Analyzing my website logs I saw a lot of POST requests to: {domain}/index.php/installtemplate/adminhtml_installtemplate/index and {domain}/index.php/installtemplate/adminhtml_installtemplate/...
0
votes
1answer
76 views

Data Security has been compromised

In my Magento 1.9 store, some of the Customer's Default Billing name and Address has been amended. I first got to know this when one of my customer complained to me about their name that has been ...
1
vote
0answers
49 views

I have Chinese chars in the contents of my session files. Have I been hacked?

I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
2
votes
0answers
63 views

Is Magento 2 REST API CSRF-proof?

As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
1
vote
1answer
84 views

Magento 2 : What's the best practice when it comes to escaping in templates?

This is a question about best practices when it comes to writing templates / block classes and security. When it comes to writing templates I know you need to escape everything that comes into the ...
0
votes
1answer
71 views

What is the data encryption / hashing key management method used in Magento 2

Like in the title. What is the data encryption / hashing key management method used in Magento 2? I found this question Encryption Method Used by Magento Enterprise, however, is the same method used ...
0
votes
0answers
27 views

Magento 1.9.1 error while security patches SUPEE-3941

When I am trying to install any patches it will give me error like below, ERROR: Patch can't be applied/reverted successfully. patching file downloader/Maged/Model/Connect.php Hunk #1 FAILED at 486. ...
0
votes
0answers
14 views

How to restrict magento rest API,it is only accessible by https?

I want to access API with HTTPS only.If anyone access my API with HTTP,it does not work.How can achieve it?
1
vote
2answers
386 views

Hunk error applying PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to Magento 1.9.2

Getting some errors applying the PATCH_SUPEE-10752_CE_v1.9.2.4_v1-2018 to my Magento 1.9.2 Checking if patch can be applied/reverted successfully... ERROR: Patch can't be applied/reverted ...
0
votes
0answers
17 views

Mganto1.9 : Item (Mage_Sales_Model_Order) with same id already exist

After I migrate my Magento shop from one hosting provider to another one I have a big problem. When I want to go in back to administration into sales->order I get an error There has been an ...
1
vote
2answers
96 views

Magento 1.9.2.1 how to prevent core_config_data from getting malicious scripts

I have been scanning the website at Magento Scan and getting the following error: Magento Compromise Injection Your site is compromised with injected JavaScript. (131) The malicious code ...
14
votes
14answers
6k views

Security Patch SUPEE-10752 - Possible issues?

A new security patch is out for Magento 1, addressing 25 APPSEC issues https://magento.com/security/patches/supee-10752 What common issues do you have to watch out for when applying this patch? ...
0
votes
0answers
26 views

Why is customer/section/* accessible publicly? Can we hide this?

I am relatively new to Magento 2. I have created a store and ran security scan and noticed I have the following: URL: https://www.mystore.com/customer/section/load/install/ or https://www.mystore.com/...
2
votes
1answer
824 views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
1
vote
1answer
25 views

How do I enable https for my site in Magento 1.9.3.7?

Where would I go in the Admin Panel of Magento 1.9.3.7 to change my site to be https and secure? Thank you.
0
votes
3answers
542 views

Magento 2 Newsletter fake subscriptions

Easily with any email you can subscribe to Magento 2 newsletter. The only available control is to send confirmation email to provided address. If provided email address is not valid Magento ...
0
votes
1answer
103 views

Hide Magento Admin Url from outside world

We have a magento server up and running. The server had the default 'admin' url which was then changed to some random string for security purpose, which only our team knows. Now we also have an admin ...
1
vote
1answer
80 views

Magento 1.3 .ru bots attack! [duplicate]

I'm being attacked by .ru bots on my Magento 1.3. Is there any plugin that works for this old version? Or a way to block them?
0
votes
1answer
36 views

Magento 1.7: PCI scan Can't Pass category URL with 'mode' param

Don't know why but the PCI scan do not pass Category URL of Magento and provide a SQL injection with 'mode' param in the below format. /main-category/sub-category/l/price:10-20/category-name.html?dir=...
0
votes
1answer
817 views

Magento 1 end of life on Nov. 2018 or not?

Please see this answer by an internal staff of Magento who states that: Magento 1.x end of life is November 2018. However on their official blog, this post states: Magento 1 has been and will ...