Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
5
votes
2answers
854 views

SUPEE-11219 Potential issues?

Magento just sent out an email about a new security patch (SUPEE-11219). https://magento.com/security/patches/supee-11219 Affected versions: Magento Commerce 1.9.0.0-1.14.4.1 Magento Open Source 1....
6
votes
5answers
890 views

Magento Security Scan not able to verify site

I am trying magento's New Magento Security Tool with below url https://account.magento.com/scanner/index/form/ But i can not Verify Site Ownership, every time when i click on Verify Confirmation ...
1
vote
3answers
214 views

Unableto verify site on Magento Security Scan

I am trying to verify my site on the Magento new security scanner https://account.magento.com/scanner/index/form/ but every time I try to verify I get an error Unable to verify this site. Please ...
1
vote
1answer
12 views

No (full) administrator access on backend Magento 2

After couple of weeks holiday i came back and stared in to an problem. I don't have access to the backend of Magento 2. My colleges have access and can do their work (product, inventory and ...
0
votes
1answer
32 views

Magento 2: Spam Customer Accounts Created Automatically

I am using Magento 2.2.4 for my e-commerce website. From last few days, customer accounts creating automatically on my website without the proper information. I already installed Mageplaza Security ...
0
votes
1answer
33 views

Any other way to increase the customer logged in time in Magento-1.9 without increasing server session time session.gc_maxlifetime?

Any other way to increase the customer logged in time without increasing server session time? If we give a value as 78,00,000 seconds (3 months) for session.gc_maxlifetime in the php.ini file, then ...
28
votes
19answers
7k views

Security Patch SUPEE-11155 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What common issues do you have to watch out for when applying this patch/upgrade? Magento 1 https://magento.com/security/...
2
votes
2answers
2k views

iframe in backend: check if backend user is logged in

I'm using Magento 1.9. I have created a module and added a page in the backend that can be accessed by the menu. This page contains an iframe (declared in a phtml file) which loads an own application....
0
votes
0answers
21 views

Blank admin login page with Security titled empty field set

We have a working Magento 2.2.9 installation in production. Everything was fine and working and no one touched the code or the settings for weeks now. Today we suddenly could not log in to admin panel ...
3
votes
1answer
5k views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
0
votes
0answers
49 views

Magento security report We were unable to check for API ACL

I scanned my site from the Magento Security . The report showed We were unable to check for API ACL (APPSEC-1679) Magento version 2.3.2 How to solve this?
0
votes
1answer
70 views

/shell/log.php?region=%31… getting called

Cannot find anything in the internet about that. Here is whats comming in: 'REQUEST_METHOD' => 'POST', 'REQUEST_URI' => '/shell/log.php?region=%31&kunyuk=%31&MageShell=%31&xcv=%31&...
0
votes
1answer
42 views

How to secure our Magento store from hackers?

I have read somewhere that hackers are making target to e-commerce sites to hack. As we know Magento provides some inbuilt security features but still wants to know more regarding security. Also, ...
0
votes
0answers
43 views

Magento 2.2.2 Security Patch Issue

I have download PRODSECBUG-2233 from magento official site patch -p1 < PRODSECBUG-2233-2.2.x-2019-07-26-08-35-48.patch When i try to use this command, it's not working and show me this errors. ...
0
votes
2answers
129 views

Magento 2, Magento Unprotected XML

I have a Magneto 2.2.3 instance and when we check for security scan it is showing below error: We have determined that your Magento installation's configuration file(s) are publicly accessible ...
0
votes
1answer
23 views

Magento 2 : How can I stop SQL attack through search bar

It's a bot that is continuously attacking, I try to hide these special characters suggestion form dashboard also try to delete them but all in vain, it comes again the next day(Magneto 2.3.1).
0
votes
0answers
13 views

*Why save magento visitor happen only when POST/PUT request?

I was involved in development of some service integration with magento. I provided this service callback URL. In controller/action I am creating a customer and making it logged in. But then I noticed ...
0
votes
1answer
18 views

How I can add security patch for magento 2.2.6 without updating magento

I have Magento 2.2.6 I want to update security patch I have lost my server databases (maybe SQL injection) my questions 1)How to update security patches? 2)Is it will helpful? 3)Is ...
18
votes
8answers
6k views

Magento 2: “Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider”

My Magento 2 development environment has started poking me with the following error message Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact ...
2
votes
2answers
2k views

Credit Card Hijack Malware Detected

It appears that our website is infected with the Credit Card Hijack malware. We ran scans on magereport.com, webscan.foregenix.com, and quttera.com, and they all say that our /js/prototype/prototype....
24
votes
17answers
6k views

Security Patch SUPEE-11086 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible." ...
0
votes
2answers
133 views

Magento 2, XSS Patch not detected (APPSEC-2143)

In Magento security scan I got the below message for my Magento instance: XS Vulnerability - Failed. XSS Patch not detected (APPSEC-2143) I am using Magento 2.2.3 How could I resolve this? Is ...
6
votes
3answers
2k views

Magento 2: When/Why to do customer:hash:upgrade?

When I run below command, it gives below output. $ php bin/magento customer:hash:upgrade . Finished What actually this command do? When I have to run this command? What changes it will do? Will ...
0
votes
0answers
27 views

Magento 2 factor authentication

Can any one help in making magento 2 2fa (two factor authentication) extension which was released with magento 2.3 and make it compatible with magento 2.2.8 or 2.2.9. This is the extension release ...
4
votes
2answers
5k views

Password Requirements Complexity - Magento

I would like to increase password security for customer and admin accounts in Magento. In addition to minimum password length, contain uppercase, lowercase, special characters, and digits. I found ...
0
votes
2answers
86 views

Magento 2 security scan failed AngularJS and XS Vulnerability

Our Magento 2 site failed the AngularJS and XS Vulnerability checks. Does anyone know how this can be fixed.
2
votes
1answer
26 views

How to secure Magento 2.x guest API

I realized that it is possible to register customers through API without authentication. https://devdocs.magento.com/guides/v2.2/rest/anonymous-api-security.html Just make a POST call to https://...
2
votes
2answers
266 views

Is it safe to have composer in production?

Is it safe/ok to have composer in production on a server hosting Magento?
1
vote
0answers
36 views

How secure is the Magento 2 File Uploader

I recently added my own form to the Magento frontend. The form contains a file type input, an used the file uploader class to save the file. But I was wondering how save this class is? I already ...
2
votes
1answer
636 views

Restricting access to anonymous web APIs

As given in the documentation here : http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html By default magento 2 only restrict Catalog, Store and CMS API from anonymous users. In a ...
0
votes
0answers
16 views

Hideit input on other forms

I stumbled across hideit input on contact us form https://magento.stackexchange.com/a/107656/70343 Makes sense to catch bots filling out the form. Just wondering whether it's worth adding to other ...
2
votes
2answers
40 views

How to securely run PHP scripts in Magento 2

I know that we can run php scripts by placing our script in root of magento 2 folder and we can load products, orders etc via object manager and perform our desired functionality. although this method ...
2
votes
2answers
48 views

Magento cloud hosted M2 EE site compromised and got malware attack

Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url: <script src="http://write-cdn.com/...
2
votes
1answer
1k views

Magento security patch issue

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
2
votes
1answer
698 views

Backend repeatedly hacked in version 1.9.1.0 CE by changing Paypal account info. How to fix and secure?

Our site has been repeatedly hacked over the past week. This is our first Magento site and it has only been up a couple months. The hacker or bot, etc. will go in and disable the other forms of ...
0
votes
2answers
69 views

Magento 2 remove version number impact

I noticed if we type /magento_version along with site url then it displays our magento version. So anyone with bad intention can check my version and exploit it. to prevent this I can disable the ...
3
votes
0answers
17 views

Magento2 Security: How to best filter GET parameters before they reach Magento?

I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; ...
0
votes
0answers
26 views

Magento 2: Is there any site which is showing missing security patch?

Is there any website which is provide a report about missing security patch or which need to install ? I just need to install patch in magento 2.1.9.
1
vote
0answers
19 views

Magento 1.9 - 503 Error timing out - Notice: iconv_strlen(): Detected an illegal character in input string

PHP 5.5.38 Magento 1.9.3.2 I've had a site running perfectly fine for over a year, and suddenly today its been timing out most of the time trying to load a page, with the 503 error page coming up ...
1
vote
2answers
91 views

Document root change help

I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache. I did the ...
3
votes
1answer
38 views

Magento 2: Load patches or update

I'm aware that this probably isn't the first time this question has been answered, but I'm wondering what is the best approach to keeping my magento 2.3.1 install secure: Should I update to 2.3.2 or ...
16
votes
15answers
6k views

SUPEE-10975 Potential Issues

SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support? So far these ...
7
votes
6answers
6k views

Check my Magento security status

I just had trouble to install the SUPEE-1533 and SUPEE-5344 on CE 1.7.0.0. I did it through the FTP method from Magentary. Question is then : how can I make sure that my Magento install got all ...
1
vote
4answers
82 views

Magento 2.3 secure your site back and front

Got a very security conscious client. I've searched stack exchange and only found partial solutions to certain security issues. I've also searched dev docs and again found one or two suggestions in ...
4
votes
0answers
91 views

I have Chinese chars in the contents of my session files. Have I been hacked?

I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
1
vote
1answer
87 views

Magento 2 Set Previous Password History

I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last ...
0
votes
1answer
74 views

Is it better to use Vue.js storefront as a frontend for magento 2?

We have to lunch a new store and planning to use Vue.js storefront on frontend. -> Will it be feasible easily - data will be interchanged using APIs -> Would there be any security issues ? -> Any ...
0
votes
0answers
15 views

Issues on blocking magento website

Is there any way where a magento website is enabled and opens even if teh internal IT firewall blocks it. Also no one blocked my website in the office. Still i am not able to open it in the office ...
1
vote
3answers
113 views

magento 1 malicious code attack in app/Mage.php

I have been working on a project and recently i am observing some malicious code is being added to the file app/Mage.php at the top of file. I have tried removing this code multiple times but it again ...
0
votes
1answer
26 views

Magento 2 recommended approach to applying patches

So far had to apply patches through command line. Bugs me there is not version control for this as in some cases changing vendor folder contents which is ignored. More for accountability with time and ...