Questions tagged [security]

Denotes security questions on Magento.

1
vote
4answers
63 views

Magento 2.3 secure your site back and front

Got a very security conscious client. I've searched stack exchange and only found partial solutions to certain security issues. I've also searched dev docs and again found one or two suggestions in ...
3
votes
0answers
83 views

I have Chinese chars in the contents of my session files. Have I been hacked?

I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such ...
0
votes
1answer
30 views

Magento 2 Set Previous Password History

I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last ...
0
votes
1answer
41 views

Is it better to use Vue.js storefront as a frontend for magento 2?

We have to lunch a new store and planning to use Vue.js storefront on frontend. -> Will it be feasible easily - data will be interchanged using APIs -> Would there be any security issues ? -> Any ...
0
votes
0answers
11 views

Issues on blocking magento website

Is there any way where a magento website is enabled and opens even if teh internal IT firewall blocks it. Also no one blocked my website in the office. Still i am not able to open it in the office ...
1
vote
3answers
82 views

magento 1 malicious code attack in app/Mage.php

I have been working on a project and recently i am observing some malicious code is being added to the file app/Mage.php at the top of file. I have tried removing this code multiple times but it again ...
0
votes
2answers
44 views

Document root change help

I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache. I did the ...
0
votes
1answer
24 views

Magento 2 recommended approach to applying patches

So far had to apply patches through command line. Bugs me there is not version control for this as in some cases changing vendor folder contents which is ignored. More for accountability with time and ...
1
vote
0answers
100 views

Magento 2.3: How to configure magento CLI commands to use custom names for dangerous redis commands

Environment OS: Ubuntu 18.04 LTS Server: Apache 2.4 Database: MySQL v14.14 distribution 5.7.25 PHP: 7.2 Redis: 5.0.4 Issue Following the digitalocean tutorial referenced ...
0
votes
0answers
9 views

Magento 2 admin backend security

In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
0
votes
2answers
179 views

Unableto verify site on Magento Security Scan

I am trying to verify my site on the Magento new security scanner https://account.magento.com/scanner/index/form/ but every time I try to verify I get an error Unable to verify this site. Please ...
3
votes
1answer
61 views

Magento 2 create ajax request from out of magento

I wanna create Ajax request from empty HTML with jQuery. I do like this $.ajax({ url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****", type: "POST", ...
18
votes
7answers
6k views

Magento 2: “Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider”

My Magento 2 development environment has started poking me with the following error message Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact ...
3
votes
1answer
21 views

Magento Phishing Attempt

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt. ...
2
votes
1answer
4k views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
4
votes
1answer
4k views

Password Requirements Complexity - Magento

I would like to increase password security for customer and admin accounts in Magento. In addition to minimum password length, contain uppercase, lowercase, special characters, and digits. I found ...
15
votes
14answers
5k views

SUPEE-10975 Potential Issues

SUPEE-10975 has been released, it would be great to know if anyone runs into any issues while trying to apply this, will this conflict with the most recent patch that adds 7.2 support? So far these ...
1
vote
0answers
49 views

How to enable Two Factor Authentication for Customer Accounts

I would like to enable two-factor-authentication for Customer Accounts, but as per the documentation (https://docs.magento.com/m2/ce/user_guide/magento/extension-install-two-factor-authentication.html)...
3
votes
1answer
370 views

Magento Security Scan reports Malicious Javascript without files

I am having a Magento 1.9.3 installation which is set up for the Magento Security Scan. For a while now I am getting a "Issues found" report, stating that there is malicious Javascript on my website....
1
vote
2answers
79 views

Why admin added to the site?

Today automatically added two admins to my site? Is my site hacked? What should I do to fix this bug?
0
votes
0answers
22 views

Do I need to update to 2.3.1?

If I have a store set up on 2.3 and I'm having issues getting it to update to 2.3.1 , what are the cons of not updating?
23
votes
17answers
4k views

Security Patch SUPEE-11086 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible." ...
0
votes
1answer
88 views

Want to install SUPEE-11086 patch for magento 1.9.2.0 version

I want to install SUPEE-11086 patch Magento 1.9.2.0 version. Does anyone have an idea about this?
2
votes
1answer
38 views

What does Magento 1's end of life mean for security?

With Magento 1 nearing it's end of life in June 2020, what are the biggest threats when it comes to security?
0
votes
2answers
52 views

HTTPS security is compromised by http://www.mfeuk.co.uk/js/mt/widget/frontend.js

can anyone help with this, I'm not anywhere close to calling myself proficient in magento but can normally track most things by trial and error, I have the problem that on my checkout page I have ...
7
votes
5answers
9k views

How to apply the Magento 2 patches?

I'm using the Magento 2.1.6 and I want to apply the patch CE-MAGETWO-67805.patch. How can I apply the *.patch files?
0
votes
0answers
91 views

which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE

I know how to install a patch file. But which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE. Does anyone know which is the patch I should apply for 1.14.2.0 EE?
0
votes
0answers
40 views

Security problem: newsletter/subscribe has not been whitelisted

i have just move the my magento store to new hosting then im facing this issue In the system.log file im just getting this error , also follows this step but still not did not get any luck. still ...
2
votes
2answers
4k views

Magento 1.9 CE security fixing end of life

I just read all answers from this question: Future Support of Magento 1.9 - Coming Magento 2.0 But I can't find a clear date or an official reference about the end of life date for Magento 1.9. Is ...
14
votes
15answers
8k views

Security Patch SUPEE-10752 - Possible issues?

A new security patch is out for Magento 1, addressing 25 APPSEC issues https://magento.com/security/patches/supee-10752 What common issues do you have to watch out for when applying this patch? ...
0
votes
0answers
18 views

Magento1 website Security patch installation by script then error show

Magento1 website Security patch installation by script and when run url in browser (like http://www.mywebsite.com/applypatch.php)then below error show: ERROR: "/app/etc/" must exist for proper ...
0
votes
1answer
26 views

Magento1 website Security patch installation by script

Magento1 my website i have installing following Security patch: Security patch 10975 Security patch 10415 Security patch 9767 Security patch 8788 Security patch 7405 but i want script in my root ...
4
votes
2answers
248 views

Carding attack on website

I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal. This doesn't seem to be doing enough to stop the attacks. Paypal threatens to shut off my account, ...
1
vote
0answers
122 views

I Have Install this (SUPEE 11086 ) Patch in Magento 1.9.0.4 but Data.php is not working?

I have Install SUPEE 11086 Patch install successfully but not work Properly in backed side? Thanks.
0
votes
1answer
106 views

how to prevent xss attacks and sql injection in magento 2 [closed]

I need to know if there are some configuration from Bo or some patch to prevent those type of attack.
2
votes
2answers
198 views

Failed Magento SUPEE 6482 Security Check (APPSEC-1030) with Version 1.9.3.7 CE

The new Magento Security Scanner reports that there are vulnerabilities on the website and that patch SUPEE 6482 is required. This occurs even when there are no Modules enabled. However, we are ...
1
vote
1answer
569 views

Magento1 SUPEE-11086 Potential Issues? [duplicate]

The Description of the patch SUPEE-11086 is: SUPEE-11086, Magento Commerce 1.14.4.1 and Open Source 1.9.4.1 contain multiple security enhancements that help close remote code execution (RCE), ...
6
votes
1answer
180 views

Critical Vulnerability in Magestore Store Locator extension [closed]

Magento released an announcement about a critical Vulnerability in Magestore Store Locator extension There's been no patch released by the actual vendor - Magestore Does anyone know: What the ...
2
votes
1answer
847 views

Magento security patch issue

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
1
vote
0answers
69 views

How to implement content security policy in magento 2

I want to know how to implement CSP on Magento 2 with GTM. The site has multiple stores. Tried to google but was unable to find any concrete result. Implimenting a Content Security Policy Magento 1....
4
votes
2answers
302 views

Database possibly compromised

I want to know if strangers have accessed the database. If so, I want to find out how they got access to the database. I found a strange trigger in the database (screenshot below).
0
votes
0answers
18 views

Security steps and permission to have for Magento2

I did penetration testing, I got some duplicate theme files in my pub/static/theme, On deleting them something wrong happened with my lib/web the entire folder got empty. Still dont know how this ...
2
votes
1answer
31 views

Security Report - patch 8788

Patch 8788 is available for <= 1.9.2.4. I have 1.9.3.4. How can I fix the issues addressed?
1
vote
0answers
7 views

Creating custom 2FA provider

I'd like to enable the 2FA extension but I'd like to write my own provider (e.g. not Authy or Google Authenticator). Anybody who can point me in the right direction? I have been working with ...
2
votes
1answer
140 views

is this a spam email or real

Message ID : <201812262203.wBQM3RsD009630@web1.gohost.sk> Sent Date : Wed, 26 Dec 2018 22:03:27 +0000 From : magento@gohost.sk Sender MailID : magento@gohost.sk Reply To : magento@gohost.sk To : ...
44
votes
16answers
11k views

Security Patch SUPEE-10570 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What issues should I look out for when upgrading or applying this patch? SUPEE-10570 SUPEE-10570, Magento Commerce 1....
37
votes
9answers
15k views

Security Patch SUPEE-10415 - Possible Issues?

New Magento 1 patch has been released, SUPEE-10415. This patch provides protection against several types of security-related issues Info page: https://magento.com/security/patches/supee-10415 ...
2
votes
2answers
226 views

Contact form hack

I recently faced a problem where, I am receiving emails from an unknown source. Somehow they bypass the validation for email and sending me SQL statement in email fields for example: (SELECT CHAR(113)...
1
vote
2answers
2k views

Magento Payment Methods Not Showing - Shows a CC Form Instead

I have noticed a strange issue recently on the Magento checkout. The same thing occurs whether I am using the default onpage Magento checkout, or if I am using the lotusbreath onepage checkout ...
0
votes
3answers
1k views

Magento 2 Newsletter fake subscriptions

Easily with any email you can subscribe to Magento 2 newsletter. The only available control is to send confirmation email to provided address. If provided email address is not valid Magento ...