Vendors are actively bypassing the security patch for a year-old Magento vulnerability, a new research shows. The Magento platform is an open-source eCommerce solution widely used by merchants to create custom stores on the internet. In April 2020, Magento released a security patch for a critical vulnerability (CVE-2020-3722) that allowed threat actors to remotely execute arbitrary code on eCommerce sites using the Magento platform.
The security patch released by Magento was intended to fix the vulnerability and protect merchants from potential attacks. However, many vendors were found to be actively bypassing the security patch and leaving their stores exposed. According to security researchers, multiple attempts have been made by vendors to bypass the vulnerability and exploit the Magento platform.
The researchers believe that the vulnerability is more widespread than it was thought initially. Since the vulnerability affects eCommerce sites using the Magento platform, any failure to patch the vulnerability can leave merchants exposed to various cyber-attacks. The research suggests that merchants need to be more vigilant about patching their Magento sites or hiring an external security firm to ensure that the security patch is in place.
Moreover, merchants should enable two-factor authentication, which adds an extra layer of security by requiring an additional code from a trusted device. This way, even if the vulnerability is being exploited, the merchants’ data would still be secure. It is also important for merchants to keep their software updated and ensure that all recent security patches are implemented.
Overall, merchants need to be aware of the security risks posed by the Magento vulnerability and take necessary steps to protect their stores. Ignoring this vulnerability can lead to serious data losses, so it is important to act swiftly and address the issue in a timely manner. With the right measures in place, merchants can keep their online stores safe from potential threats.
This Cyber News was published on www.securityweek.com. Publication date: Sun, 22 Jan 2023 10:48:00 +0000