Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [security]

Denotes security questions on Magento.

1
vote
1answer
30 views

What does Magento 1's end of life mean for security?

With Magento 1 nearing it's end of life in June 2020, what are the biggest threats when it comes to security?
0
votes
0answers
14 views

How to configure ModSecurity on PLESK for Magento 2?

For moment I disabled 3 rules in the security rules, what do you advise ?
0
votes
0answers
13 views

Magento 2.3: How to rename dangerous redis commands whilst maintaining magento functionality?

Environment OS: Ubuntu 18.04 LTS Server: Apache 2.4 Database: MySQL v14.14 distribution 5.7.25 PHP: 7.2 Redis: 5.0.4 Issue Following the digitalocean tutorial referenced within the magento ...
0
votes
1answer
68 views

Want to install SUPEE-11086 patch for magento 1.9.2.0 varsion

But this patch is not available for magento 1.9.2.0. Anyone have idea about this?
0
votes
1answer
65 views

which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE

I know how to install a patch file. But which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE. Does anyone know which is the patch I should apply for 1.14.2.0 EE?
0
votes
0answers
23 views

Security problem: newsletter/subscribe has not been whitelisted

i have just move the my magento store to new hosting then im facing this issue In the system.log file im just getting this error , also follows this step but still not did not get any luck. still ...
0
votes
0answers
14 views

Magento1 website Security patch installation by script then error show

Magento1 website Security patch installation by script and when run url in browser (like http://www.mywebsite.com/applypatch.php)then below error show: ERROR: "/app/etc/" must exist for proper ...
0
votes
1answer
23 views

Magento1 website Security patch installation by script

Magento1 my website i have installing following Security patch: Security patch 10975 Security patch 10415 Security patch 9767 Security patch 8788 Security patch 7405 but i want script in my root ...
3
votes
2answers
118 views

Carding attack on website

I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal. This doesn't seem to be doing enough to stop the attacks. Paypal threatens to shut off my account, ...
1
vote
0answers
109 views

I Have Install this (SUPEE 11086 ) Patch in Magento 1.9.0.4 but Data.php is not working?

I have Install SUPEE 11086 Patch install successfully but not work Properly in backed side? Thanks.
1
vote
1answer
440 views

Magento1 SUPEE-11086 Potential Issues? [duplicate]

The Description of the patch SUPEE-11086 is: SUPEE-11086, Magento Commerce 1.14.4.1 and Open Source 1.9.4.1 contain multiple security enhancements that help close remote code execution (RCE), ...
20
votes
16answers
3k views

Security Patch SUPEE-11086 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible." ...
6
votes
1answer
128 views

Critical Vulnerability in Magestore Store Locator extension [closed]

Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension There's been no patch released by the actual vendor - Magestore Does anyone know: What the ...
1
vote
0answers
45 views

How to implement content security policy in magento 2

I want to know how to implement CSP on Magento 2 with GTM. The site has multiple stores. Tried to google but was unable to find any concrete result. Implimenting a Content Security Policy Magento 1....
0
votes
1answer
66 views

how to prevent xss attacks and sql injection in magento 2 [closed]

I need to know if there are some configuration from Bo or some patch to prevent those type of attack.
0
votes
0answers
17 views

Security steps and permission to have for Magento2

I did penetration testing, I got some duplicate theme files in my pub/static/theme, On deleting them something wrong happened with my lib/web the entire folder got empty. Still dont know how this ...
2
votes
1answer
28 views

Security Report - patch 8788

Patch 8788 is available for <= 1.9.2.4. I have 1.9.3.4. How can I fix the issues addressed?
4
votes
2answers
228 views

Database possibly compromised

I want to know if strangers have accessed the database. If so, I want to find out how they got access to the database. I found a strange trigger in the database (screenshot below).
1
vote
0answers
26 views

How to enable Two Factor Authentication for Customer Accounts

I would like to enable two-factor-authentication for Customer Accounts, but as per the documentation (https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html)...
1
vote
0answers
7 views

Creating custom 2FA provider

I'd like to enable the 2FA extension but I'd like to write my own provider (e.g. not Authy or Google Authenticator). Anybody who can point me in the right direction? I have been working with ...
3
votes
1answer
82 views

Do bound parameters get escaped using the Core/Resource model?

Consider the following example: $connection = Mage::getSingleton('core/resource')->getConnection('core_read'); $email_address = $_GET['email']; $sql = 'SELECT * FROM `foo` WHERE `email_address` = ...
1
vote
1answer
79 views

Help! Credit Card Grabber Found on Magento 1.9

I've found a piece of code that contacts a really weird domain with CC info. Can someone confirm it doing something malicious? If so, what should I do without taking down the server? I'm a total ...
0
votes
0answers
14 views

Magento 2.2.2 - Restrict access to Admin and redirect to 404 if unautohrized

I need to allow specific IP's/IP range as authorized users to access Magento admin area and redirect to 404 page not found if an unauthorized IP try to access http://store.com/admin. Could think of ...
2
votes
1answer
134 views

is this a spam email or real

Message ID : <201812262203.wBQM3RsD009630@web1.gohost.sk> Sent Date : Wed, 26 Dec 2018 22:03:27 +0000 From : magento@gohost.sk Sender MailID : magento@gohost.sk Reply To : magento@gohost.sk To : ...
0
votes
0answers
17 views

ASV scan failing because of Session ID in URL

We're on a Magento 1.9.3.7 and our Aperia ASV scan is failing because of Session ID in URL. One example would be the following https://mystore.com/category.html?SID=rmdfi0m0gibepot9eom7egj384 Payload:...
0
votes
1answer
101 views

Magento 1 - Patch SUPEE-10415 is not applied

I have tried to apply path SUPEE-10415 to magento 1.9.1.0, but its won't succedeed. Please find the report below. Checking if patch can be applied/reverted successfully. ERROR: Patch can't be ...
1
vote
1answer
29 views

Prevent Magento2 display information on script on homepage

I would like to know how can i stop magento2 to printing information about my plugin and script on homepage.If u analyze my code i have got all these script that contain information about all plugin i ...
0
votes
1answer
174 views

Webgility Security Vulnerability Update [closed]

Webgility provides a module/extension for our Magento customers that enables communication with our core product, Unify. A security vulnerability was discovered in this module on October 16th, 2018 ...
3
votes
0answers
458 views

Security Patch SUPEE-10975 - Possible issues? [duplicate]

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10975 SUPEE-10975, Magento Commerce 1....
1
vote
2answers
188 views

Magento compromised, second “PayPal Express Checkout” option added sending payment to unauthorized recipient

I had an order come in that wasn't followed by a PayPal payment, so I asked the customer if he had paid, and he sent me a screenshot of the receipt which shows the payment going to "Trust Website ...
1
vote
1answer
280 views

Problem with patch SUPEE-10888 on Magento 1.9.0.1

Problem with patch PATCH_SUPEE-10888_CE_v1.9.0.1_v1-2018-09-19-03-00-53.sh on Magento 1.9.0.1, with all previous patches installed: Checking if patch can be applied/reverted successfully... ERROR: ...
1
vote
0answers
33 views

New security threat to Magento caused by it using jQuery-File-Upload?

Magento 2 uses the Blueimp jQuery File Upload Plugin v5.16.4 which has recently been identified at posing a security risk to web applications which use it. Is this an issue for Magento and should ...
15
votes
13answers
5k views

SUPEE-10975 Potential Issues

SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support? So far these ...
0
votes
0answers
16 views

Why does /soap not follow site X-FRAME header?

After a pen test a low impact security flaw was reported saying that X-FRAME-OPTIONS were not being set. Which was odd as following the devdocs recommendation (https://devdocs.magento.com/guides/v2.2/...
3
votes
2answers
509 views

Webgility RCE vulnerability

MageReport.com reported today that they released a new check concerning a recently discovered backdoor in the module Webgility. While their tool is very helpful in scanning the site and asserting ...
1
vote
1answer
273 views

How to remove malicious code from the each files of the website magento 2?

I am seeing some malicious code in the website. Each files of every folder is affected by this code. How to remove this code from the website? Is any script to remove or replace this malicious code? ...
1
vote
2answers
95 views

Magento 1.9.3.2 - Exception printing is disabled by default for security reasons

I have just moved a Magento install from one server to another and now when I try to access the frontend I get the "Exception printing is disabled by default for security reasons" error. I have ...
2
votes
1answer
52 views

How to stop fake reviews and fake signups on Magento 1 and Magento 2?

We have 2 websites one is on Magento 1 and the second is on Magento 2 , In both websites we get fake reviews and fake signups everyday. Someone told me to add captcha which will not let bots or ...
1
vote
2answers
111 views

I found some malicious code in all index.php of magento 1.9.2

Need help to stop malicious code in all index.php file Once I remove malicious code from index.php then again its apperar in index.php files malicious code like -- $swvJgN7="xQC+...
1
vote
2answers
111 views

Our Magento account was hacked; files deleted; hosting company is unable to restore

Magento 1.9.1 Porto theme Managed VPS from Hostforweb CentOS 7.x/WHM / Cpanel We got hacked. Files were deleted and our site was and is down. I have a full cPanel backup which I made available to our ...
1
vote
1answer
128 views

Magento2 Two factor authentication for Frontend

Do you guys know where to purchase or download M2 2FA ext for FRONTEND (or both frontend and admin)
0
votes
0answers
33 views

How to secure my website magento 2

I want to secure my website from script injection and other Security failures so is there patch or somthing that i have to do or upload to do so. Also i want advice from you concerning sécurity ...
2
votes
1answer
56 views

How to create a nonce / secure hash in Magento 2?

I want a simple link to activate a customer out of an email that gets sent to the admin on registration. I am using this module: https://github.com/enrico69/magento2-customer-activation for the ...
3
votes
1answer
68 views

Can anyone have any idea of security patch file of SUPEE-9652 V2?

As i'm unable to find the SUPEE-9652 V2 version related security patch, because of these I'm unable to run another patch i.e, SUPEE-10570, can anyone provide me the solutions For Magento 1.9.x. ...
1
vote
0answers
20 views

Access orders page with wget [duplicate]

people. My question may be simple but I can't find an answer. I want to be able to get the page source of my orders with a command. I plan something like wget -user myUserName -password myPassword ...
2
votes
0answers
192 views

Magento Security Scan reports Malicious Javascript without files

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan. For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
0
votes
0answers
251 views

Magento known issue while upgrade from 1.9.3.9 to 1.9.3.10? [duplicate]

I just got notification that 1.9.3.10 is released with SUPEE-10888 curious to know if someone has already update it and faced any issue?
19
votes
16answers
6k views

Security Patch SUPEE-10888 - Possible issues?

SUPEE-10888 is a new security patch for Magento 1 which addresses 12 security issues. https://magento.com/security/patches/supee-10888 SUPEE-10888, Magento Commerce 1.14.3.10 and Open Source 1.9.3....
1
vote
0answers
68 views

Magento 2 CE + CyberSource Checkout [closed]

I'm trying to set up a 2.2.5 store with CyberSource v3, however, I keep receiving below error. You are not authorized to view this page. The transaction has not been processed. If the problem ...
1
vote
1answer
49 views

Magento 1.9 with no security patches got hacked. How to install the security patches without Magento Connect?

Magento 1.9.1 Porto theme Our Magento got hacked. The hacker deleted our user accounts and created one for themselves with the user ID of shopmanager1. I had to connect to the database, delete his ...