Questions tagged [security]

Denotes security questions on Magento.

Filter by
Sorted by
Tagged with
5
votes
2answers
743 views

SUPEE-11219 Potential issues?

Magento just sent out an email about a new security patch (SUPEE-11219). https://magento.com/security/patches/supee-11219 Affected versions: Magento Commerce 1.9.0.0-1.14.4.1 Magento Open Source 1....
0
votes
1answer
32 views

Magento 2: Spam Customer Accounts Created Automatically

I am using Magento 2.2.4 for my e-commerce website. From last few days, customer accounts creating automatically on my website without the proper information. I already installed Mageplaza Security ...
0
votes
1answer
33 views

Any other way to increase the customer logged in time in Magento-1.9 without increasing server session time session.gc_maxlifetime?

Any other way to increase the customer logged in time without increasing server session time? If we give a value as 78,00,000 seconds (3 months) for session.gc_maxlifetime in the php.ini file, then ...
1
vote
1answer
12 views

No (full) administrator access on backend Magento 2

After couple of weeks holiday i came back and stared in to an problem. I don't have access to the backend of Magento 2. My colleges have access and can do their work (product, inventory and ...
0
votes
0answers
21 views

Blank admin login page with Security titled empty field set

We have a working Magento 2.2.9 installation in production. Everything was fine and working and no one touched the code or the settings for weeks now. Today we suddenly could not log in to admin panel ...
0
votes
0answers
49 views

Magento security report We were unable to check for API ACL

I scanned my site from the Magento Security . The report showed We were unable to check for API ACL (APPSEC-1679) Magento version 2.3.2 How to solve this?
0
votes
1answer
70 views

/shell/log.php?region=%31… getting called

Cannot find anything in the internet about that. Here is whats comming in: 'REQUEST_METHOD' => 'POST', 'REQUEST_URI' => '/shell/log.php?region=%31&kunyuk=%31&MageShell=%31&xcv=%31&...
0
votes
1answer
41 views

How to secure our Magento store from hackers?

I have read somewhere that hackers are making target to e-commerce sites to hack. As we know Magento provides some inbuilt security features but still wants to know more regarding security. Also, ...
0
votes
0answers
42 views

Magento 2.2.2 Security Patch Issue

I have download PRODSECBUG-2233 from magento official site patch -p1 < PRODSECBUG-2233-2.2.x-2019-07-26-08-35-48.patch When i try to use this command, it's not working and show me this errors. ...
0
votes
0answers
13 views

*Why save magento visitor happen only when POST/PUT request?

I was involved in development of some service integration with magento. I provided this service callback URL. In controller/action I am creating a customer and making it logged in. But then I noticed ...
0
votes
1answer
18 views

How I can add security patch for magento 2.2.6 without updating magento

I have Magento 2.2.6 I want to update security patch I have lost my server databases (maybe SQL injection) my questions 1)How to update security patches? 2)Is it will helpful? 3)Is ...
0
votes
1answer
23 views

Magento 2 : How can I stop SQL attack through search bar

It's a bot that is continuously attacking, I try to hide these special characters suggestion form dashboard also try to delete them but all in vain, it comes again the next day(Magneto 2.3.1).
0
votes
2answers
127 views

Magento 2, Magento Unprotected XML

I have a Magneto 2.2.3 instance and when we check for security scan it is showing below error: We have determined that your Magento installation's configuration file(s) are publicly accessible ...
0
votes
2answers
130 views

Magento 2, XSS Patch not detected (APPSEC-2143)

In Magento security scan I got the below message for my Magento instance: XS Vulnerability - Failed. XSS Patch not detected (APPSEC-2143) I am using Magento 2.2.3 How could I resolve this? Is ...
0
votes
0answers
27 views

Magento 2 factor authentication

Can any one help in making magento 2 2fa (two factor authentication) extension which was released with magento 2.3 and make it compatible with magento 2.2.8 or 2.2.9. This is the extension release ...
2
votes
1answer
26 views

How to secure Magento 2.x guest API

I realized that it is possible to register customers through API without authentication. https://devdocs.magento.com/guides/v2.2/rest/anonymous-api-security.html Just make a POST call to https://...
1
vote
0answers
36 views

How secure is the Magento 2 File Uploader

I recently added my own form to the Magento frontend. The form contains a file type input, an used the file uploader class to save the file. But I was wondering how save this class is? I already ...
0
votes
0answers
16 views

Hideit input on other forms

I stumbled across hideit input on contact us form https://magento.stackexchange.com/a/107656/70343 Makes sense to catch bots filling out the form. Just wondering whether it's worth adding to other ...
2
votes
2answers
40 views

How to securely run PHP scripts in Magento 2

I know that we can run php scripts by placing our script in root of magento 2 folder and we can load products, orders etc via object manager and perform our desired functionality. although this method ...
2
votes
2answers
48 views

Magento cloud hosted M2 EE site compromised and got malware attack

Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url: <script src="http://write-cdn.com/...
0
votes
2answers
67 views

Magento 2 remove version number impact

I noticed if we type /magento_version along with site url then it displays our magento version. So anyone with bad intention can check my version and exploit it. to prevent this I can disable the ...
3
votes
0answers
17 views

Magento2 Security: How to best filter GET parameters before they reach Magento?

I want to increase the security of one of our Magento2 installations by filtering GET parameters. It seems that, according to our WAF, especially "filter" parameters are often tried to be exploited; ...
0
votes
0answers
26 views

Magento 2: Is there any site which is showing missing security patch?

Is there any website which is provide a report about missing security patch or which need to install ? I just need to install patch in magento 2.1.9.
0
votes
2answers
86 views

Magento 2 security scan failed AngularJS and XS Vulnerability

Our Magento 2 site failed the AngularJS and XS Vulnerability checks. Does anyone know how this can be fixed.
1
vote
0answers
19 views

Magento 1.9 - 503 Error timing out - Notice: iconv_strlen(): Detected an illegal character in input string

PHP 5.5.38 Magento 1.9.3.2 I've had a site running perfectly fine for over a year, and suddenly today its been timing out most of the time trying to load a page, with the 503 error page coming up ...
3
votes
1answer
38 views

Magento 2: Load patches or update

I'm aware that this probably isn't the first time this question has been answered, but I'm wondering what is the best approach to keeping my magento 2.3.1 install secure: Should I update to 2.3.2 or ...
28
votes
19answers
7k views

Security Patch SUPEE-11155 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. What common issues do you have to watch out for when applying this patch/upgrade? Magento 1 https://magento.com/security/...
1
vote
4answers
81 views

Magento 2.3 secure your site back and front

Got a very security conscious client. I've searched stack exchange and only found partial solutions to certain security issues. I've also searched dev docs and again found one or two suggestions in ...
0
votes
1answer
73 views

Is it better to use Vue.js storefront as a frontend for magento 2?

We have to lunch a new store and planning to use Vue.js storefront on frontend. -> Will it be feasible easily - data will be interchanged using APIs -> Would there be any security issues ? -> Any ...
1
vote
1answer
87 views

Magento 2 Set Previous Password History

I'm currently trying to make my website PCI DSS compliant and one of the requirements is to ensure that, when an administrator user selects a new password, it cannot be the same as any of the last ...
0
votes
0answers
15 views

Issues on blocking magento website

Is there any way where a magento website is enabled and opens even if teh internal IT firewall blocks it. Also no one blocked my website in the office. Still i am not able to open it in the office ...
1
vote
3answers
113 views

magento 1 malicious code attack in app/Mage.php

I have been working on a project and recently i am observing some malicious code is being added to the file app/Mage.php at the top of file. I have tried removing this code multiple times but it again ...
1
vote
2answers
90 views

Document root change help

I am using Magento 2.3.1 Open Source. I installed it from the .zip file in the public_html folder (I didn't know any better at the time) in my account at my web host, running on Apache. I did the ...
1
vote
0answers
27 views

Magento 2 admin backend security

In addition to the extension settings, extension installation loads a lot of unnecessary content. if you now look at the configuration menu in the admin panel, under the tab of the main settings of ...
0
votes
1answer
26 views

Magento 2 recommended approach to applying patches

So far had to apply patches through command line. Bugs me there is not version control for this as in some cases changing vendor folder contents which is ignored. More for accountability with time and ...
3
votes
1answer
98 views

Magento 2 create ajax request from out of magento

I wanna create Ajax request from empty HTML with jQuery. I do like this $.ajax({ url: "http://****.com/rest/V1/integration/admin/token?username=***&password=****", type: "POST", ...
3
votes
1answer
22 views

Magento Phishing Attempt

I got a suspicious email which looked pretty legit today and wanted to share with the community and maybe people who are more security savvy than me can tell me more about this Phishing attempt. ...
1
vote
2answers
82 views

Why admin added to the site?

Today automatically added two admins to my site? Is my site hacked? What should I do to fix this bug?
0
votes
0answers
23 views

Do I need to update to 2.3.1?

If I have a store set up on 2.3 and I'm having issues getting it to update to 2.3.1 , what are the cons of not updating?
2
votes
1answer
41 views

What does Magento 1's end of life mean for security?

With Magento 1 nearing it's end of life in June 2020, what are the biggest threats when it comes to security?
1
vote
0answers
103 views

Magento 2.3: How to configure magento CLI commands to use custom names for dangerous redis commands

Environment OS: Ubuntu 18.04 LTS Server: Apache 2.4 Database: MySQL v14.14 distribution 5.7.25 PHP: 7.2 Redis: 5.0.4 Issue Following the digitalocean tutorial referenced ...
0
votes
1answer
96 views

Want to install SUPEE-11086 patch for magento 1.9.2.0 version

I want to install SUPEE-11086 patch Magento 1.9.2.0 version. Does anyone have an idea about this?
0
votes
0answers
107 views

which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE

I know how to install a patch file. But which dedicated patch file to Install patch SUPEE-11086 for Magento 1.14.2.0 EE. Does anyone know which is the patch I should apply for 1.14.2.0 EE?
0
votes
0answers
54 views

Security problem: newsletter/subscribe has not been whitelisted

i have just move the my magento store to new hosting then im facing this issue In the system.log file im just getting this error , also follows this step but still not did not get any luck. still ...
0
votes
0answers
18 views

Magento1 website Security patch installation by script then error show

Magento1 website Security patch installation by script and when run url in browser (like http://www.mywebsite.com/applypatch.php)then below error show: ERROR: "/app/etc/" must exist for proper ...
0
votes
1answer
29 views

Magento1 website Security patch installation by script

Magento1 my website i have installing following Security patch: Security patch 10975 Security patch 10415 Security patch 9767 Security patch 8788 Security patch 7405 but i want script in my root ...
4
votes
2answers
332 views

Carding attack on website

I'm getting hit with carding attacks on my website. I've enabled AVS options like so in Paypal. This doesn't seem to be doing enough to stop the attacks. Paypal threatens to shut off my account, ...
1
vote
0answers
124 views

I Have Install this (SUPEE 11086 ) Patch in Magento 1.9.0.4 but Data.php is not working?

I have Install SUPEE 11086 Patch install successfully but not work Properly in backed side? Thanks.
1
vote
1answer
629 views

Magento1 SUPEE-11086 Potential Issues? [duplicate]

The Description of the patch SUPEE-11086 is: SUPEE-11086, Magento Commerce 1.14.4.1 and Open Source 1.9.4.1 contain multiple security enhancements that help close remote code execution (RCE), ...
24
votes
17answers
6k views

Security Patch SUPEE-11086 - Possible issues?

Magento has released a new security patch for M1, and updates for M1 and M2. These releases include critical security fixes. "We strongly recommend that all merchants upgrade as soon as possible." ...