Fresh Patches for Critical Vulnerabilities in Magento

  • January 29, 2020

Delaware, USA – January 29, 2020 – Magento issued fresh updates for Magento Commerce and Open Source editions to address six critical and important vulnerabilities, two of which could be exploited for arbitrary code execution. Critical Vulnerability CVE-2020-3719 is an SQL injection flaw that could be exploited to leak sensitive information. Critical vulnerabilities CVE-2020-3718 and CVE-2020-3716, are security bypass flaw and deserialization of the untrusted data, and they are the ones that can attract the attention of cybercriminals since they could lead to arbitrary code execution. Path traversal flaw and two stored cross-site scripting vulnerabilities were marked as critical, adversaries can exploit them to collect the information to prepare further attacks. Patches available:

At the time Magento is not discovered attacks exploiting these vulnerabilities in the wild, but it usually takes a few days before the MageCart groups create a working exploit. After the publication of PoC exploit by security researchers, the situation usually gets worse and the spike in skimming attacks on e-commerce platforms occurs. It is essential to install the latest updates and make sure that your website has not been compromised before. MageCart groups often create rogue admin accounts or install backdoors, so 20% of compromised sites become reinfected within 24 hours after the skimmer is removed. To monitor the security of your critical business applications that face public internet and detect web application misuse and breach attempts, you can use your SIEM and Web Application Security Framework rule pack available in Threat Detection Marketplace:https://my.socprime.com/en/integrations/web-application-security-framework

Search:
Share It With Your Peers: