Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
7
votes
6answers
1k views

Magento Security Scan not able to verify site

I am trying magento's New Magento Security Tool with below url https://account.magento.com/scanner/index/form/ But i can not Verify Site Ownership, every time when i click on Verify Confirmation ...
9
votes
11answers
6k views

SUPEE-11219 Potential issues?

Magento just sent out an email about a new security patch (SUPEE-11219). https://magento.com/security/patches/supee-11219 Affected versions: Magento Commerce 1.9.0.0-1.14.4.1 Magento Open Source 1....
0
votes
0answers
21 views

i am getting junk entries in my database from bots [closed]

I am getting junk values in my databse from bots, with address of 3137 laguna street and pincode of 94102. per minute i am getting 30 records, how can i fix this, i am already using google recaptcha
10
votes
1answer
2k views

Magento 2.1.1 - Improve security with Content Security Policy

I have a store running fine with the latest version of Magento (currently 2.1.1) and I'm trying to improve security through Content Security Policy on Apache 2.4.7 (Ubuntu 14.04). I had removed all "&...
0
votes
0answers
47 views

Is SUPEE-11295 missing fixes?

Adobe's Security Bulletin APSB20-02 mentions 6 security issues. I've read through the changes in SUPEE-11295 and I don't think that all of these issues are getting addressed. To my understanding, the ...
0
votes
0answers
40 views

magento 2 how to secure Cookie mage-cache-sessid and enable Secured Flag

Here Am trying to enable HttpOnly and Secured Flag for Cookies mage-cache-sessid or my domain. I did configuration in admin Panel >> store >> configuration >> general >> web but still flags not ...
28
votes
21answers
10k views

Security Patch SUPEE-11155 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What common issues do you have to watch out for when applying this patch/upgrade? Magento 1 https://magento.com/security/...
0
votes
0answers
10 views

Magento EE 1.14 security patch Hunk #1 FAILED at 68

I am trying to apply patches to Magento EE 1.14 version but i am facing following issue checking file app/design/frontend/rwd/default/template/customer/form/changepassword.phtml Hunk #1 FAILED at 43....
2
votes
0answers
128 views

How upcoming SameSite cookie changes could affect Magento or 3rd modules, possible issues?

On February, 4, Google is set to roll out a new Chrome update that promises a bunch of new features designed to make the browser faster and more secure — including a new approach to cookies. The ...
0
votes
0answers
28 views

Magento 2 How to secure my checkout success page?

So I have create completely custom checkout page and after successfull order Im receiving via my ajax call a "Increment Id" from backend. With this increment Id I'm redirecting user to /checkout/...
-1
votes
2answers
31 views

Need magento 1.9.3.3 to apply patch

I want to know list of patches for my website which is in 1.9.3.3 version of magento please suggest.
1
vote
0answers
18 views

Unknown index “UsernamePasswordFormAuthenticve_index” in cron logfile - security issue?

Today i noticed a really strange index and code dump in cron.log: UsernamePasswordFormAuthenticve_index is successfully finished ^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@...
0
votes
0answers
27 views

Which files under Magento webroot should be executable?

Security best practices suggest that you should never have an executable in a public web directory. However, in a typical Magento install (in my very limited experience), this is not true. Even in ...
2
votes
2answers
51 views

How to securely run PHP scripts in Magento 2

I know that we can run php scripts by placing our script in root of magento 2 folder and we can load products, orders etc via object manager and perform our desired functionality. although this method ...
2
votes
1answer
729 views

Restricting access to anonymous web APIs

As given in the documentation here : http://devdocs.magento.com/guides/v2.0/rest/anonymous-api-security.html By default magento 2 only restrict Catalog, Store and CMS API from anonymous users. In a ...
0
votes
1answer
42 views

Need help to stop malicious code in index.php file

Need help to stop malicious code in index.php file Please help me if anyone have faced this same issue. I am using Magento ver. 1.9.4.3 index.php : * @category Mage */ $swvJgN7="xQC+...
2
votes
1answer
1k views

Magento security patch issue

I scanned my site from the New Magento Security Tool available from magento partner portal. The report showed me two Vulnerability issues 1) SSL TLS - Your server supports TLSv1.0. Please update ...
0
votes
0answers
34 views

Transparent Data Encryption in Magento 2.3 Database

I need to encrypt customer data (company name, contact person, emai, address, etc.) within the magento mysql database. I'd like to realize this without introducing encryption/decryption in every ...
0
votes
0answers
24 views

Authentication type for API to be used by third party partners | Magento 2

We are creating an API in M2 enterprise edition to sell our giftcodes to a partner. The partner will have functionalities like: To have Store Credit Can buy giftcodes View buy history We cannot ...
2
votes
1answer
785 views

Backend repeatedly hacked in version 1.9.1.0 CE by changing Paypal account info. How to fix and secure?

Our site has been repeatedly hacked over the past week. This is our first Magento site and it has only been up a couple months. The hacker or bot, etc. will go in and disable the other forms of ...
0
votes
1answer
153 views

failed applying security patch SUPEE-11155 - Hunk #1 FAILED

patching file app/Mage.php Hunk #1 FAILED at 813. 1 out of 1 hunk FAILED -- saving rejects to file app/Mage.php.rej Can anyone point me in the right direction as to why I've a bunch of messages that ...
2
votes
2answers
114 views

How to stop fake reviews and fake signups on Magento 1 and Magento 2?

We have 2 websites one is on Magento 1 and the second is on Magento 2 , In both websites we get fake reviews and fake signups everyday. Someone told me to add captcha which will not let bots or ...
0
votes
0answers
57 views

Security patch 11219 risk error for Magento 1.9.2.4

Security patch 11219 risk Error for Magento 1.9.2.4 I'm using Magento 1.9.2.4 version in the Security patch error(magereport.com) But in the Magento Security patch not have this version (https://...
2
votes
1answer
242 views

Is Magento 2 REST API CSRF-proof?

As far as I could see Magento 2 REST API uses PHP session ID for authentication during XHR requests on cart and checkout pages, and there appears to be no additional CSRF token or something similar to ...
3
votes
1answer
57 views

Shell script dumps Model source code

Weird things happening. I've written a customized product import script which is executed as a shell script. In this script, I gather some XML input, parse it into an array and then try to import the ...
1
vote
3answers
249 views

Unableto verify site on Magento Security Scan

I am trying to verify my site on the Magento new security scanner https://account.magento.com/scanner/index/form/ but every time I try to verify I get an error Unable to verify this site. Please ...
1
vote
1answer
16 views

No (full) administrator access on backend Magento 2

After couple of weeks holiday i came back and stared in to an problem. I don't have access to the backend of Magento 2. My colleges have access and can do their work (product, inventory and ...
0
votes
1answer
58 views

Magento 2: Spam Customer Accounts Created Automatically

I am using Magento 2.2.4 for my e-commerce website. From last few days, customer accounts creating automatically on my website without the proper information. I already installed Mageplaza Security ...
0
votes
1answer
44 views

Any other way to increase the customer logged in time in Magento-1.9 without increasing server session time session.gc_maxlifetime?

Any other way to increase the customer logged in time without increasing server session time? If we give a value as 78,00,000 seconds (3 months) for session.gc_maxlifetime in the php.ini file, then ...
2
votes
2answers
2k views

iframe in backend: check if backend user is logged in

I'm using Magento 1.9. I have created a module and added a page in the backend that can be accessed by the menu. This page contains an iframe (declared in a phtml file) which loads an own application....
1
vote
0answers
48 views

Blank admin login page with Security titled empty field set

We have a working Magento 2.2.9 installation in production. Everything was fine and working and no one touched the code or the settings for weeks now. Today we suddenly could not log in to admin panel ...
3
votes
1answer
6k views

Console showing Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block:

I don't know what it's means and how to remove this error. it's showing in my chrome console . but not in firefox console.. (index):1 Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=...
0
votes
0answers
66 views

Magento security report We were unable to check for API ACL

I scanned my site from the Magento Security . The report showed We were unable to check for API ACL (APPSEC-1679) Magento version 2.3.2 How to solve this?
1
vote
1answer
85 views

/shell/log.php?region=%31… getting called

Cannot find anything in the internet about that. Here is whats comming in: 'REQUEST_METHOD' => 'POST', 'REQUEST_URI' => '/shell/log.php?region=%31&kunyuk=%31&MageShell=%31&xcv=%31&...
0
votes
1answer
48 views

How to secure our Magento store from hackers?

I have read somewhere that hackers are making target to e-commerce sites to hack. As we know Magento provides some inbuilt security features but still wants to know more regarding security. Also, ...
0
votes
0answers
105 views

Magento 2.2.2 Security Patch Issue

I have download PRODSECBUG-2233 from magento official site patch -p1 < PRODSECBUG-2233-2.2.x-2019-07-26-08-35-48.patch When i try to use this command, it's not working and show me this errors. ...
0
votes
2answers
253 views

Magento 2, Magento Unprotected XML

I have a Magneto 2.2.3 instance and when we check for security scan it is showing below error: We have determined that your Magento installation's configuration file(s) are publicly accessible ...
0
votes
1answer
36 views

Magento 2 : How can I stop SQL attack through search bar

It's a bot that is continuously attacking, I try to hide these special characters suggestion form dashboard also try to delete them but all in vain, it comes again the next day(Magneto 2.3.1).
0
votes
0answers
18 views

*Why save magento visitor happen only when POST/PUT request?

I was involved in development of some service integration with magento. I provided this service callback URL. In controller/action I am creating a customer and making it logged in. But then I noticed ...
0
votes
1answer
30 views

How I can add security patch for magento 2.2.6 without updating magento

I have Magento 2.2.6 I want to update security patch I have lost my server databases (maybe SQL injection) my questions 1)How to update security patches? 2)Is it will helpful? 3)Is ...
18
votes
8answers
7k views

Magento 2: “Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact your hosting provider”

My Magento 2 development environment has started poking me with the following error message Your web server is set up incorrectly and allows unauthorized access to sensitive files. Please contact ...
2
votes
2answers
2k views

Credit Card Hijack Malware Detected

It appears that our website is infected with the Credit Card Hijack malware. We ran scans on magereport.com, webscan.foregenix.com, and quttera.com, and they all say that our /js/prototype/prototype....
24
votes
17answers
8k views

Security Patch SUPEE-11086 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible." ...
0
votes
2answers
267 views

Magento 2, XSS Patch not detected (APPSEC-2143)

In Magento security scan I got the below message for my Magento instance: XS Vulnerability - Failed. XSS Patch not detected (APPSEC-2143) I am using Magento 2.2.3 How could I resolve this? Is ...
6
votes
3answers
2k views

Magento 2: When/Why to do customer:hash:upgrade?

When I run below command, it gives below output. $ php bin/magento customer:hash:upgrade . Finished What actually this command do? When I have to run this command? What changes it will do? Will ...
0
votes
0answers
32 views

Magento 2 factor authentication

Can any one help in making magento 2 2fa (two factor authentication) extension which was released with magento 2.3 and make it compatible with magento 2.2.8 or 2.2.9. This is the extension release ...
4
votes
2answers
5k views

Password Requirements Complexity - Magento

I would like to increase password security for customer and admin accounts in Magento. In addition to minimum password length, contain uppercase, lowercase, special characters, and digits. I found ...
0
votes
2answers
103 views

Magento 2 security scan failed AngularJS and XS Vulnerability

Our Magento 2 site failed the AngularJS and XS Vulnerability checks. Does anyone know how this can be fixed.
2
votes
1answer
38 views

How to secure Magento 2.x guest API

I realized that it is possible to register customers through API without authentication. https://devdocs.magento.com/guides/v2.2/rest/anonymous-api-security.html Just make a POST call to https://...
2
votes
2answers
319 views

Is it safe to have composer in production?

Is it safe/ok to have composer in production on a server hosting Magento?

1 2 3 4 5 13