Contents
Which is the latest security update for Magento?
The release of Magento 2.3.5-p1 marks the first phase of our implementation and makes CSP available in report-only mode by default. Magento has released updates for Magento Commerce and Open Source editions. For more information on security updates available for Magento, please see APSB20-22 for details.
What can an unauthenticated user do in Magento?
An unauthenticated user in Magento 2.x, or an authenticated user in Magento 1.x, can execute SQL statements that allow arbitrary read access to the underlying database. Note: this issue was addressed in previous patches 2.2.8 and 2.3.1 and also in separately released patches PRODSECBUG-2198.
Is there a vulnerability in Magento store locator?
A critical vulnerability exists in the Magestore Store Locator extension version 1.0.2 (and earlier versions) that could result in unauthorized access to sensitive information. Magento urges customers running this extension to immediately disable this extension or block requests.
How can I execute arbitrary code in Magento?
An authenticated user with admin privileges can execute arbitrary code through crafted email template code when previewing the template. An authenticated user with admin privileges to create sitemaps can execute arbitrary code by crafted filenames that include php extension within the XML filename.
Which is vulnerability does this warning relate to?
One thing I’m getting when testing one shop is ‘Path disclosure: Magento root directory leaked:’, but it seems safe with all the other tests. Which vulnerability does this warning relate to?
Is there a Magento 1.7.0.2 version?
Magento 1.7.0.2 version passed successfully, but 1.8.1.0 and 1.9.1.0 do not. I’ve checked our custom templates as well to ensure those are updated, which they are.
Is it possible to disable symlinks in Magento 1.x?
This will not affect your current symlink settings, if you manually enabled symlinks prior to 1.9.3.2 they will stay enabled, although you cannot see the setting anymore in admin. Users using modman to manage Magento 1.x modules should ensure that they do not disable symlinks as this will disable the modman modules.
What should I do to protect my Magento account?
Your effort to protect your Magento installation starts with the initial setup, and continues with the security-related configuration settings, password management, and ongoing maintenance. Use the latest version of Magento to ensure that your installation includes the most recent security enhancements.
Why do I need.htaccess file in Magento?
Magento includes .htaccess files to protect system files when using the Apache web server. If you use a different web server such as Nginx, make sure that all system files and directories are protected. For an sample Nginx configuration, see: magento-nginx.conf on GitHub.